This means the test suite can actually exercise logic that depends on
different lease expiration times for different shares in one bucket.

The entire ZKAPAuthorizer client resource hierarchy is now protected by this
token, ensuring any callers at least have local filesystem access to the
Tahoe-LAFS node.

Along with an in-memory implementation of a pass factory that works with it.

We can put a plugin here later.