[PoC] Allow to uplod avatars via a public API

Fixes #10549

* Avatar must be sqaure
* POST must be done using a mutlipart form
* Key is avatar

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>