Create $public client

[eduardoboucas]

Currently, it's possible to make a collection or custom endpoint open to the public (i.e. requests without a bearer token) using the settings.authenticate property.

Whilst this works, it's an all or nothing kind of thing. It's not possible to take full advantage of ACL features like limiting access to a subset of the collection fields or specify a permissions filter. We could achieve this by introducing a special client (e.g. $public) that would represent unauthenticated requests.

Assigning public permissions to a resource would work in the same way as granting permissions to any other client does – i.e. a POST request to /api/clients/$public/resources.

We can easily keep support for settings.authenticate for backward compatibility.