Read-only client tokens

[paulgb]

Allow client tokens to have read-only permissions.

[rolyatmax]

This is now implemented in #373. There are some caveats that should be documented, however:

1. The Y-Sweet server can only prevent updates made to its in-memory source of truth. This is sufficient for ensuring no read-only tokens can write to the source of truth. Preventing local updates in the UI, however, is still left up to the application developer. If the developer doesn't prevent these local mutations in their app, a read-only user may think they are making edits to the shared document when in reality their edits are silently rejected on the server.
2. Y-Sweet authorization tokens are only recognized by Y-Sweet. That means if the developer uses a second Yjs Provider alongside the Y-Sweet Provider, the read-only user's edits may sync to a client who has full read/write access across the second provider and then in turn get synced to the document held on the Y-Sweet server.