Agent registration via public networks

This issue replaces the phase 2 sections of Callosum RPC issues.

- [ ] manager/agent: Add config entries for the server public/private keypair
- [ ] manager: Implement a callosum authenticator interface to check if the agent public key is the registered one via scaling groups DB.
- [ ] manager: Extend DB models\* Each scaling group stores an "agent" public key generated by `zmq.curve_keypair()`.
- Each scaling group may have different authentication modes: "local" and "curve". The "local" mode is for agent deployments in the same LAN where the manager resides (which does not perform any authentication), while the "curve" mode is for remote agents connected via the public Internet.
- When generating a new agent keypair, the server should NOT store the private key – we should return it only once and forget afterwards. (Keep in mind that debug logs should not contain it!)

- [ ] manager: A new auth-required API to query the public key of the manager server so that users can setup their own agents easier?
- [ ] agent: Make all communications with kernels to pass-through the agent (currently all the streaming traffic for application service ports goes directly from the kernel runner in containers to the manager) – callsoum will provide a simplified tunneling API for this.
┆Issue is synchronized with this [Asana task](https://app.asana.com/0/1159751085623729/1159756857742146) by [Unito](https://www.unito.io/learn-more)

JIRA Issue: BA-315