Login / logout for external API clients

For now, we still use two cookies to store the JWT token, one of which is accessible to JavaScript. However, only JavaScript on subdomains of ecamp3.ch can read that cookie. External API clients will need:
- [ ] A way to get access to at least the URI of the logged in user. We add that to the JWT token payload [here](https://github.com/ecamp/ecamp3/blob/devel/api/src/EventListener/JWTCreatedListener.php#L25), but the external application has no way to access the JWT token payload
- [ ] A way to delete the cookies on logout, such as a dedicated logout endpoint in the API which deletes the Cookies (sets them to an expired expiry date)
- [ ] A way to check whether the user is still logged in, e.g. with a boolean flag `authenticated` on the API root endpoint. Having the information on the API root endpoint would be nice because that endpoint will need to be fetched almost always. If we instead say the external API client needs to fetch the user endpoint, that's one more request necessary before the client can even decide whether the user is logged in or not.
- [ ] Ideally, a way to refresh the login / JWT token, but we don't have that yet in our frontend either