Essential improvements to the HTTP API used by https://github.com/matrix-org/mjolnir-widget

Nobody has claimed this yet.

These are improvements that have to be coordinated with the widget, but are also needed to be implemented before any other changes are made.

- [ ] Put the openID token into the authorization header as a Bearer token and validate the request with middleware so we're not bodging it in each api endpoint.
- [ ] Declaratively specify the format of request bodies for validation using some middleware for express.
- [ ] Namespace the endpoints, we are almost certainly going to have a web api for controlling a specific mjolnir in future too and these shouldn't clash.
- [ ] Update the test client used for the appservice integration tests accordingly
- [ ] Can resolve openID tokens from different homeservers than just the one the appservice is deployed on https://github.com/matrix-org/mjolnir/pull/364/files#r1023075345

Start with the checklist and the linked discussion about resolving OpenID tokens, then locate the Express API middleware and the appservice integration test client. Coordinate the API changes with mjolnir-widget; done means bearer-token validation, declarative request-body validation, namespaced endpoints, updated integration tests, and cross-homeserver token resolution.

Written by the indexing model from the issue text.