server: let AUTH_INTERNAL access @anoninternal

Both methods enforce the internal aspect, but @anoninternal really just
means the resolver does not require an "authenticated user" context,
which means it's still perfectly safe if there is one.

With this in place, any resolver that may have to be called from an
anonymous context can be switched from @internal to @anoninternal
without breaking existing users. Of course it can only be switched if it
really does not require a user context.

Don't uppercase error messages

Run modernize

See https://pkg.go.dev/golang.org/x/tools/gopls/internal/analysis/modernize

It's mostly interface{} -> any, but also two quite useful applications
of slices.Contains.

server: add @admin directive implementation

This will be used at least by meta.sr.ht in the near future.

server/directives: disambiguate AnonInternal error message

AUTH_INTERNAL won't work with AnonInternal.

auth: add AuthContext.Access

Same logic as server.Access, but lower-level. Useful to check for
a permission not covered by the GraphQL schema @access directives
(such as builds.sr.ht secrets).

server: fix error message on missing grant in Access

The error returned when a token is missing a required grant would
be "Access denied for invalid auth method" which is confusing.
Fix this with a more accurate error message.

server/directives: handle auth.AUTH_ANON_INTERNAL in Access

Allow AUTH_COOKIE to access @private fields

Add @anoninternal support code

This is a slightly better approach to the previous commit.

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

server: add @private directive glue code

webhooks: initial prototype for GQL-native webhooks

Fix bug with internal authentication

Make authorization errors more specific

Import GQL server interfaces from gql.sr.ht