Merge stream avatar working branch into staging

[avacreeth]

Merging our working stream avatar branch into staging so we don't diverge too much.

• introduces the concept of "highly privileged apps" which have full node access, as well as access to special modules
• highly privileged apps are explicitly listed by app id
• adds avatar updater and runtime service (will change)

[CLAassistant]

All committers have signed the CLA.

[michelinewu]

/Azurepipelines run

[azure-pipelines[bot]]

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.