Create initial implementation

[nathanclevenger]

I think typically JWT token-based services accept accountId, secret, & optionally scope & expiration TTL for the JWT

The advantage of this is that we don't have to wait for the lookup of an API key in ctx.do for the enrichment, as the metadata is in the token.

The downside is that it's much harder (although not impossible) to invalidate a token. We would need to create a list of invalidated token IDs ... and for performance we wouldn't want to wait for those to come through, although they could be in a env variable or fetched after validation (so potentially the initial request of a given worker could be allowed as to not have to await the result list).

[sam-lippert]

Created in 70cf4b2, token invalidation tracked in #5