Introduce new annotation for resources that makes the authentication
filter look at the URI query for a parameter containing the API key
instead of a header.
This enables clients that cannot supply headers to use authentication-
locked resources.

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Renaming as per reviewer suggestion to better reflect its purpose:
stevespringett#642 (comment)

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>

Implement reviewer suggestion to replace either-or logic of looking at
the URI query parameter instead of the header into a hierarchy, which
keeps the header as the preferred location for the API key in every case
and makes the query parameter the opt-in alternative that's enabled by
the annotation.
Review:
stevespringett#642 (comment)

Signed-off-by: Kirill.Sybin <kirill.sybin@lex-com.net>