Better support for build tokens

[jameswestman]

As part of the Flathub donations & payments project, we would like to make it easier for developers to use build tokens to upload their apps. Currently, build tokens are given out on an ad-hoc basis, but we want to have a self-service UI accessible to all developers.

In order to do this, some changes are needed to the way builds and build tokens work in flat-manager. Most significantly, builds are currently not associated with an app. Build tokens can only be scoped to "all builds" or "a specific build by ID", and separately can be scoped to "build"/"upload"/"publish". This means we can't create tokens that allow developers to create builds for their app, then manage exactly that set of builds.

To fix this, I'd like to associate each build with an app prefix. There will be an endpoint to query builds by app, and tokens will have a field to restrict their scope to one or more app prefixes.

Another issue is that there is no authentication on downloading from build repos. This needs to be changed so that builds can be marked as public, and if they are not public, a build token is required to access them.