Provide a streamlined way for authority owners to make requests on behalf of a user

A publisher using third-party authorities will often want to make API requests on behalf of one of their users, for use cases such as:

1. Fetching information about a user and their annotations in order to display a profile page
2. Mediating communication between h and the end-user through a third-party proxy:
```
[Publisher's web/mobile etc. application] <---> [Publisher's API service] <--> [h]
```

They can currently do this as follows:

1. Generate a grant token following the steps at https://h.readthedocs.io/en/latest/publishers/authorization-grant-tokens/
2. Make a request to `/api/token` to exchange the grant token for an access token
3. Make the API request passing the access token in an `Authorization` header

This process has the downside that step (2) requires an extra call to h, and the publisher then has to cache their access tokens and refresh them periodically in order not to have to repeat steps (1) and (2) for every single API request.

For the use cases here we should be able to eliminate step (2) and instead provide publishers with a way to directly make API requests on behalf of one of their users.

**Possible approaches**

1. Accept the JWT grant token from step (1) in the `Authorization` header
2. Accept client credentials (client ID + client secret) as authorization for the request, and allow the userid to be specified via a header in the request
3. We already have some support for proxy authentication in the service via the `PROXY_AUTH` env var and `X-Forwarded-User` header. For cases where a publisher is running their own h service, perhaps this is already sufficient? We would need to recap how this works and document it.