Expose histogram aggregation via API

[maxalbert]

This depends on #1075. It will also require extending the claims structure and claims checks to allow for this new aggregation type.

[greenape]

So I think the first thing here is that we do not (at this stage) provide a mechanism for getting unsanitised histograms from the API.

As to the claims, I'm wondering if the way to structure this is to effectively bump the current spatial_aggregation claim down a level and have a structure thus:

'daily_location': {'permissions':..., 'aggregations':{'spatial':..., 'histogram':true}}