Add API to create new `AppVersion` instances

[diox]

We need to automate AppVersion creation. Our idea is to provide an API that would be called by Firefox release management when a new version (beta or release) is released. That API would require a specific permission we would give their user.

[diox]

Ideally this would be called even earlier than beta/release date, during merge day, when https://hg.mozilla.org/mozilla-central/file/tip/browser/config/version.txt is updated. That way we'd have the appversions ready for use as soon as a Nightly is released for a given version.

I'm thinking the API would look something like this:
PUT https://addons.mozilla.org/api/v4/applications/firefox/appversion/79.0a1/ -> AMO would create (ignoring those that already exist) 79.0, 79.0a1, 79.* for Firefox
PUT https://addons.mozilla.org/api/v4/applications/android/appversion/79.0a1/ -> AMO would create (ignoring those that already exist) 79.0, 79.0a1, 79.* for Firefox for Android

@eviljeff thoughts ? I've talked to releng and it seems doable on their side, they want more details (and a bug) before committing though, so I want to flesh out the API more before filing the bug for them.

[eviljeff]

PUT https://addons.mozilla.org/api/v4/applications/firefox/appversion/79.0a1/ -> AMO would create (ignoring those that already exist) 79.0, 79.0a1, 79.* for Firefox

so, /79.0a1/ creates version 79.0a1 (major=79, minor1=0, alpha='a', alpha_ver=1) - the actual version, plus 79.0 (major.minor1) and 79.* (major.*)? Makes sense.

/79.1a2/ would try to generate 79.1a2, 79.1 and 79.*?

[diox]

Yeah, that's what I was thinking.

[diox]

Re-opening because I just changed my mind on the authentication mechanism, we're going to use the external JWT-based auth with API keys instead.

[diox]

QA: this API is documented over at https://addons-server.readthedocs.io/en/latest/topics/api/applications.html

You need a user with theAppVersions:Create permission, and more importantly, you need to use API key authentication which I'm not sure you're familiar with outside of tools like web-ext - it's a bit tricky to use with curl for instance, as you need to generate a short-lived token and use it. Let me know if you need help verifying.