As an administrator, I'd like to invite Nuxeo external user to a specific document

Leverage nuxeo-platform-login-token to handle authentication.

Add a notion of "virtual" principal:

• virtual if the username starts with virtualuser:.
• add NuxeoPrincipal#isVirtual()
• Make the UserManager creates a transient principal when retrieving a Principal based on a virtual username

When a temporary ACE is created:

• compute a virtual username based on the given username + doc id + reponame (virtualuser:troger@nuxeo.com_docid_reponame)
• find a separator token that can't be used in a default username (so that we can split on it to retrieve the document / email)
• register a new token on nuxeo-platform-login-token for that username

When notifying a virtual user for a given rights, add the token in the URL so that the user can be logged in.