[Tracker] APKAM: PKAM per app & device, with namespace access control capability

[gkc]

Is your feature request related to a problem? Please describe.

• atSign owners are too involved in actual management of private keys
• Current permissions approach is all-or-nothing - you either have access or you don't

Describe the solution you'd like

• Limit likelihood of compromise of private keys
  • Limit private keys required by apps to the bare minimum - a single keypair (whose private key may be held on a TPM / secure element)
  • No more exporting of keys files for import by other apps+devices
  • Easy-to-use management of app access and app namespace permissions
• Limit blast radius if private keys are compromised
  • Apply access controls to apps' use of the atSign's namespace
  • Easy-to-use modification / revocation of app access and app namespace permissions

### Tasks
- [ ] https://github.com/atsign-foundation/at_protocol/issues/30
- [ ] https://github.com/atsign-foundation/at_protocol/issues/31
- [ ] APKAM: Finalize design
- [ ] APKAM: Full implementation
- [ ] https://github.com/atsign-foundation/at_server/issues/1357
- [ ] https://github.com/atsign-foundation/at_libraries/issues/367
- [ ] https://github.com/atsign-foundation/at_client_sdk/issues/1078
- [ ] https://github.com/atsign-foundation/at_server/issues/1423
- [ ] https://github.com/atsign-foundation/at_client_sdk/issues/1076
- [ ] https://github.com/atsign-foundation/at_server/issues/1356

[gkc]

Completed draft detailed design in PR53

[gkc]

Moving to PR57 as will not get to it in PR56