Fine grained publishing rights

[line-o]

Is your feature request related to a problem? Please describe.

Grant individual users publish rights. This will allow us to

a) to know who uploaded what
b) to limit publish rights to certain packages

Describe the solution you'd like

User "Anne" is granted publishing rights for package "Blobber".
Anne can now POST to /publish and will receive a 201 or 200 for versions of "Blobber" and using their correct credentials.
For any other content the endpoint will respond with 403 and 401 if no or wrong credentials were submitted.
Credentials can be a BEARER token or a cookie

Describe alternatives you've considered

Basic Authentication is not deemed secure enough.

Additional context

The above is derived from discussions with @joewiz and others.
It depends on a fix for #67 and has implications on #25 and #65