API authentication scoping

We currently support API authentication through JWTs. We already support multiple users (authorized_keys file), but no authorization or scoping of tokens. This means a XIS that should only be able to search VCs and request access tokens, can also create DIDs or issue VCs. Maybe we should add some basic form of scoping, to have more controllable authz.

The authorized_keys format makes this a bit hard however, since it is only about authentication, not authorization (e.g. setting a scope for an entry).

On the other hand, if we're going to implement user authentication we could consider OAuth2, and then the XIS/CRM system piggyback that authentication for internal APIs. But then, OAuth2 for pure server-to-server authentication is a gray area (implicit grant is discouraged).

Start by reviewing the existing JWT authentication flow and the authorized_keys format, then compare the proposed scoping approach with the OAuth2 alternative described in the issue. Define the authorization boundaries for actions such as searching VCs, requesting access tokens, creating DIDs, and issuing VCs before implementation; done means a decided, testable authentication and authorization design.