Add a "signed" authentication scheme for easier redirects

[ezekg]

E.g., right now we're duplicating routes on our .pkg subdomains to work around HTTP clients not forwarding authentication headers from one subdomain to another, even if the top level domain matches. As a better workaround, we should add a signed authentication scheme, which can be embedded into URLs, containing signed and encrypted credentials, e.g.:

https://raw.pkg.keygen.sh/foo/bar/hello.txt
303 See Other
Location: https://api.keygen.sh/v1/accounts/foo/artifacts/hello.txt?auth=signed:xxx.yyy.zzz

Essentially, it could be like a signed cookie almost.

Related to #409, #863, and #877?