Add "public" OCS endpoint to manage the avatar

[nickvergessen]

So our beautiful clients can manage the avatar too.

Currently it's only possible via index.php/ which has CSRF protection that prevents mobile clients

[nextcloud-bot]

GitMate.io thinks possibly related issues are #5456 (Privacy: Avatar public available), #8525 (Add Avatar to Groups), #2090 (Add max share size to public upload), #4118 (Add endpoint for current bruteforce protection timeout), and #7893 (Add endpoint to list apps enabled in the server and its urls).