Add Headless API

[boatbomber]

Closes #638.

You can read the API docs here: https://github.com/boatbomber/rojo.space/blob/headless-api-docs/docs/headless-api.md

[sasial-dev]

You might wanna change my impl. a bit but:

[boatbomber]

I'm curious why RequestAccess lets the users pick out which APIs they want to allow. I can't think of a case where you would want to give a plugin only some of the permissions it's asking for and for a plugin to only use some of the permissions it wants.

Honestly, I can't remember my original reasoning so I'm gonna redo this to be all or nothing to create a simpler UX & DX. Thanks for bringing it up.

[boatbomber]

Addressed all the feedback here and on the docs PR! 🚀

[Dekkonot]

Reviewing the docs made me realize I have a more logistical comment for this PR: it exposes an ApiContext, which means we need to care about it a lot more than we current do. This applies to the Rust side of things too.

This isn't a problem, but it means we need to consider it in versioning and should probably also document both sides.