Add bearer-token checks against a list of allowed parties

[razgraf]

The public routes are currently checking against a single allowed bearer token. To allow for multiple integrators to use our deployed endpoint at the same time, the checks should be done against a list of allowed bearer tokens.

This should also be documented in the README or on docs.sablier.com in the merkle api section.