Allow a consumer app attach an **already-verified** per-request course auth

[karendolan]

Allow a consumer app attach an already-verified per-request course
authorization to the request, and have genRouteHandler prefer it over the
shared session for that request's course + role fields. The user still must
match the session as usual.

This library concedes that "if a consumer sets
verifiedCourseAuth, the library trusts it." That is the same trust model the
library already extends to launchInfo/session values a consumer can influence,
and it is gated behind a deliberately-named field.

Features

1. Removes launch session requirement for /api/public/* endpoints
2. Allows optional req.verifiedCourseAuth to be passed by client app, with the specific typed attributes
3. Continues to allow TTM and Admin to pass a different userId, as before, but not students, as before