worker/api: remove token in favor of callback URLs

Instead of sending a `token` to workers, send back to URLs:

 1. "location": URL at which the job can be inspected (GET) and updated
    (PATCH).
 2. "artifact_location": URL at which artifacts should be uploaded to.

The actual URLs remain the same, but a client does not need to stitch
them together manually (except appending the artifact's name).

Unfortunately, the client code generated by `deepmap` does not lend
itself to this style of APIs. Use standard http.Client again, which is a
partial revert of 0962fbd30.

internal/worker/server.go

@@ -261,9 +261,10 @@ func (h *apiHandlers) RequestJob(ctx echo.Context) error {
 	}
 
 	return ctx.JSON(http.StatusCreated, requestJobResponse{
-		Token:    token,
-		Manifest: jobArgs.Manifest,
-		Targets:  jobArgs.Targets,
+		Manifest:         jobArgs.Manifest,
+		Targets:          jobArgs.Targets,
+		Location:         fmt.Sprintf("/jobs/%v", token),
+		ArtifactLocation: fmt.Sprintf("/jobs/%v/artifacts/", token),
 	})
 }