Asymmetric Tokens and server issuing challenges

The [3231 RFC](https://github.com/rust-lang/cargo/issues/10519) describes that servers can issue a one time challenge to better protect against token reuse. This was not implemented in https://github.com/rust-lang/cargo/pull/10771 and should be implement it before stabilization.