2755: Verify permission signatures on create.

2755: Verify permission signatures on create.

Phase 1 of #2755: when creating a new collection, verify any permission
signatures found in the manifest.  Unsigned locators in the manifest are
implicitly permitted (to be disabled in Phase 4)

* New "Locator" class to parse, examine and manipulate Keep locators.
* Collections.create checks permission signatures in a manifest.
* Collections.show signs locators in a manifest.
* collections_controller_test.rb: new unit tests to exercise signed
  manifests and related features:
    - "create collection with signed manifest"
    - "create collection with signed manifest and explicit TTL"
    - "create fails with invalid signature"
    - "create fails with uuid of signed manifest"
    - "multiple locators per line"
    - "multiple signed locators per line"
* application.yml.example: new configuration variables
    - Rails.configuration.blob_signing_key
    - Rails.configuration.blob_signing_ttl

(refs #2755)