Create "labeling" (package metadata) service

[chuckadams]

We need to be able to hang arbitrary metadata off of packages and individual versions of packages. To this end, AC needs a pair of service endpoints that implements more or less a key-value store to store and retrieve arbitrary JSON documents. This should be fairly free-form to start with, but we'll start tightening up the requirements as we progress

We'll start with a few requirements:

• An API key will be required, with the necessary permissions. See the /admin endpoints for an example of how this is currently done. Even read access will require a key with read permissions for the moment.
• Documents should be assigned two internal ids: a ULID or UUIDv7 (haven't decided which) and a hash of their normalized content. Documents should retrievable by either of these, as well as the human-readable key they were uploaded with.
• Keys should be prefixed with the package DID (plc or web) -- any non-matching key should be rejected.
• Bodies should be valid JSON and no larger than 16 Kilobytes. This limit should be configurable, but it will never be large. Large metadata will have to be done in the form of pointers to documents elsewhere (which will have their own requirements, such as signing).
• Multiple documents may be stored under a single key, in an append-only fashion. Deletion of a document by one of its internal ids should be possible with the right permissions, as well as deleting all documents stored under a key.
• Retrieval of documents by key or prefix should return all documents as ndjson, using cursor pagination based on the ULID/UUIDv7 ids.

While Redis is practically made for this purpose, I'd prefer the initial implementation be done with Postgres. We'll research alernative durable KV stores later, which won't rule out Redis, but we'll also consider things like Cassandra, DynamoDB, or possibly more exotic solutions.

[chuckadams]

For an example of some real world data payloads for labeling, check https://github.com/fairpm/fair-protocol/blob/main/spec-labeling.md. Internally I'd like a fairly flexible internal representation like said K/V store, but if we only implement the labeling spec endpoints and payloads, I'm more than happy with that.

[chuckadams]

With the hackathon wrapped up, I'll cut the flair off the title. We're seeing some good results, though they're currently residing in private repos from which we'll cherry pick, lift and shift, or otherwise finagle into AC and hammer into shape. I think we'll probably have less than a full K/V implementation, but more focus is good, we can abstract it away later.

We should definitely keep the standalone labeler as well, just also absorb it into AC for a one-stop-shopping sort of solution.