cloud service query: auto-bootstrap query endpoint on 401

[sdairs]

Problem

Running cloud service query against a service whose query endpoint hasn't been enabled (or doesn't list the caller's API key) returns HTTP 401 with a helpful hint (added in #115), but the user still has to run two more commands to fix it:

cloud key list                    # find my key ID
cloud service query-endpoint create <service-id> --open-api-key <key-id>

Proposed behaviour

When cloud service query hits 401 and the resolved auth source is an API key:

1. Look up the caller's API key in openapi_key_get_list by matching on the configured key string (we need a way to map a key string back to its UUID — see "How can I know what API key I'm authenticated with?" follow-up).
2. On an interactive TTY, prompt: Authorize your API key (<name> <uuid>) for this service's query endpoint? [y/N].
3. On yes, upsert the endpoint (additively, per cloud service query-endpoint create should be additive #122) and retry the query transparently.
4. Skipped under --json, --no-interactive, or non-TTY stdin.

Depends on

• cloud service query-endpoint create should be additive #122 — additive query-endpoint create so we don't blow away existing authorizations.
• Knowing which API key ID the user is authenticated with (see separate issue).

Related

• rewrite cloud service query to use query endpoints #115