divviup-api could manage collector auth tokens for subscribers

[tgeoghegan]

We generate a unique collector auth token for each task and then expect subscribers to get them from divviup-api and subsequently use them to authenticate requests to the Leader's collection API.

It would be nice if divviup-api had a wrapper around the DAP layer collection API. It could verify that the client is logged in as a user who has appropriate privileges on the task and then make a collection request to the leader on their behalf.

[jbr]

We could also provide an cli for decrypting the collection result if we save the private part of the hpke config for them?