Policies should be able to extend credentials

[mikz]

Some policies will need to access/modify credentials the client authenticated with.

Unfortunately they are extracted and sent to backend in one method:
https://github.com/3scale/apicast/blob/632d0f38a436b95c864be0c901713ff0cd3dbc5c/gateway/src/apicast/proxy.lua#L238-L293

That makes it very hard to hook into this process.

For example adding support for End User Plans needs to add user_id to the credentials: 3b2a0da

One way to solve this would be to split credentials extraction into own module.
Another way would be to have some "credentials extractor" object that is exported into the shared context by the apicast module, but could be exported by another module and overridden.

Another one would be to do this in rewrite phase and leave access phase just for the actual call.
Then any policy could manipulate the credentials between the rewrite and access phase.

/cc @kevprice83