crypto: harden API surface

Make it explicit that expiration is not being tested with Decrypt, and
test that the expiration is meaningful with DecryptWithExpiration.

Add legacy webhooks worker implementation

Overhaul crypto module

Part 1 of merging gql.sr.ht with core-go

Add crypto module with depessimised webhook signing from gitsrht-update-hook