initial code for limited invalidation

This issue is an initial version for limited invalidation. It has not been finished yet. I will send another code review when it's ready.

Here're what I did in this patch:
1. I added AuthenticationMode, InvalidateService, DefaultInvalidateService and InvalidateHandler
2. I added AuthType, SecurityToken and invalidation string to RemoteContentRequest. Those will be used for checking invalidation.
3. I added AuthenticationMode to SecurityToken

TODO items:
1. Currently entry point for invalidation is:
GET /api/rest/invalidate?invalidationKey=xxx
The final format should be:
POST /api/rest/invalidate
Content-Type application/json
{
  invalidationKeys: {xxx}
}
How can I generate such a request with oauth signed?

2. There is a pitfall about DefaultInvalidationService.
PHP cache is different from Java. CacheStorageFile will cache http request to hard disk. So DefaultInvalidationService::$marker should be stored to hard disk too. I will fix it in next patch.

3. unittests