Allow API endpoint access with a predefined token

[PVince81]

Quick and dirty approach for accessing the metrics endpoint without admin credentials, not that user friendly but works.

Fixes #100

Drawbacks:

• it uses its own token approach (inspired by how the music app does it for Ampache). Making it use the proper token facility requires many more changes to be able to generate tokens with more restrictions (might need core/server changes)
• only one token for now
• not configurable in the web UI, need occ

Issues:

• unsure about the NC-Token header, need to check if there are other places where we use different headers
• header vs URL param (which could leak more easily)

[PVince81]

rebased for CI.

if this minimal approach is acceptable and secure enough I can then move forward to write tests for this

thoughts ? @LukasReschke @nickvergessen @kesselb

[PVince81]

I've added unit tests

[MorrisJobke]

I fixed the info text (which said OC-Token instead of NC-Token). But then it works fine 👍