api: Introduce reader_tokens for extra access.

api: Introduce reader_tokens for extra access.

reader_tokens are API tokens whose read permissions will be added to
the primary API token's.  For actions that only read resources, like
:index and :show, you can now omit the API token as long as you
provide at least one reader_token.

This allows users to get access to one-off resources without
interrupting their primary session.  For example, Workbench will use
it to access Collections shared via secret link.