Add a session key for immutable uploads

[itamarst]

The current design of the GBS HTTP protocol for uploading buckets establishes continuity for the series of writes and/or abort by relying on the storage index. Insofar as an untrusted third party knows the storage index (perhaps another storage server?), that third party can mess with the upload, e.g. abort it half-way.

This suggests that there is some need for a shared secret tied to each individual client->server upload.

There are two possible high-level approaches:

1. The server chooses a session key and shares it with client.
2. The client chooses the session key.

The second pattern matches existing Tahoe-LAFS interaction patterns, so that is what we'll go with as first pass.

[GitHub <noreply@…>]

In fe6a2f6f/trunk:

Merge pull request #1146 from tahoe-lafs/3820.gbs-immutable-upload-session

Use an upload secret for GBS immutable uploads

Fixes ticket:3820
Fixes ticket:3826