Add API endpoints to request support data tokens #91

New endpoints:
route: POST /support/token/[id=uuid]
headers: 'Use': Upload or Download

See /src/routes/(unauthenticated)/projects/[id=number]/token as a guideline.

You don't need to replicate all the ownership checks that are in the project token endpoint.

What needs to be checked:

• valid API token (just with locals.security.requireApiToken()
• valid support data request (404 if not found)
• If use is Upload, we only want this to be uploaded once (hence the DateUploaded field)

Questions:

• What if the upload fails and we need to retry? If we block subsequent uploads, then any retries will fail. Should we have a separate handler just to mark it as uploaded? Thoughts @chrisvire ?