Introduce public API to retrieve an API key for organizations, given an authenticated user

Use case

We're working on support for private packages with igniter (not external repos, that will come later), and part of the workflow includes looking up package information using the API. The user might issue this command:

mix igniter.install my_org/package

We would then want to read the package information via the API, and find out what the latest, non-revoked, non-release-candidate version is (or just latest non-revoked if nothing meets that criteria), and provide a "good" pin for it, i.e "~> 3.5" in the users mix.exs.

Current Work

Our first attempt was to use Mix.State.fetch!(:repos), but after discussion with @ericmj it became clear that the auth_key we get from that is not correct/sufficient for reading packages via the API. This code is in main of igniter presently. It works, in fact, for explicitly provided versions like mix igniter.install org/package@3.5, so all that is left for us to solve is:

1. have them run mix local.hex to update and get this new API.
2. get an api key for looking this info up (or tell the user to run mix hex.user auth and confirm they have access to the org

Start by tracing the current Mix.State.fetch!(:repos) and auth_key handling described in the issue, then review how mix local.hex and mix hex.user auth establish access. Define the public API and authentication behavior needed for an authenticated user to retrieve an organization key, and verify that it supports private package lookups and the stated access checks.