Improve security of remote app connections

[mjrousos]

This helps to ensure users are choosing strong API keys by requiring them to be parsable as GUIDs. Also updates docs to explain the API key requirements and recommend HTTPS for the ASP.NET app to ensure the ASP.NET Core app can request data from it in production scenarios securely.

Fixes #144

[khellang]

Why force hexadecimal GUIDs? You could shave a lot of extra bytes on the wire by choosing more compact representations using higher-base encodings, while keeping the same amount of entropy.

If the goal is to enforce 128 bits of entropy, could you have a low-level ReadOnlyMemory<byte> (or just byte[]?) property with some convenience methods/propeties to set it using a hexadecimal GUID? Then validate the bytes instead?

[mjrousos]

@khellang yea, there are a lot of options here. I prefer a string over a byte[] since that makes it easier to read from some config sources.

And we could just say "string with minimum 12 characters" or something like that, but forcing the characters to be hex digits makes it less likely users will choose a "bad" password.

I'll re-work this given @twsouthwick's recent changes so that it just validates with a regex data annotation looking for 32 hex characters (with or without dashes or parentheses).