Add support for third-party OSM clients

[cyrossignol]

These changes enable third-party clients to connect to the Workspaces APIs more easily. JOSM is the primary use case--the JOSM preferences UI does not provide a way to select a workspace by ID (via HTTP header) or authenticate via the TDEI.

With this PR, users can configure their tools to point to Workspaces by entering an OSM API URL. Here's a template:

https://<tdei-auth-token>@workspaces.sidewalks.washington.edu/workspace/<workspace-id>/api

...where tdei-auth-token is an access token obtained using the TDEI authentication API, and workspace-id is the ID of the workspace the client will interact with.

The tdei-auth-token value appropriates the username component of the URL. A client may also send an Authorization header with the request according to the HTTP basic authentication scheme with a username field set to the value of the TDEI access token.

In fact, this is how JOSM must be configured:

1. Edit → Preferences → OSM Server
2. Enter the OSM Server URL without the TDEI token
3. Select "Use Basic Authentication"
4. Enter the TDEI access token in the "OSM username" field
5. Enter "none" or a dummy password in the "OSM password" field

Unfortunately, even with the changes in this PR, TDEI tokens expire, and users must manually refresh and re-enter the tokens in their tools.

[uwjohnbee]

i'm not used to the keys and the locks both present in a URL, been digesting this today and unless someone man-in-the-middles us on Starbuxx wifi or has access to our webserver logs (and it's enforced https) i don't have any immediate red flags.

seems like flexibility is very important to get open source things talking to one another, so the direction seems correct. if fears become an issue perhaps these tokens become very very short-lived.

APPROVED

also make sure this works on dev cuz dev API ain't happy right now, something is still dead-stopping calls to the API without error logs i can find. mebbe we need to start runbooks by knowing how to verify services are running correctly, so i can help troubleshoot beyond docker logs.