feat: Support client authentication for UMA APIs

[joachimvh]

This is so a client like LOAMA can access the resources API to know what all the resources are that a user owns.

[termontwouter]

Is there a specific reason LOAMA cannot use the user's token? Or is this meant for long-term offline access?

[joachimvh]

I didn't actually even consider the idea of just also giving a PAT to the client :D . A PAT is specifically made for a single client though as it encodes that information, so a new PAT would have to be requested from the UMA server for the client. But would be possible. I did it like this because LOAMA already is using the standard authentication for everything else, but perhaps just using the PAT system that is already there would make more sense.