auth/bearer: log username associated with expired token

all: pass errors to panic, not strings

GraphQL's recovery middleware can't handle strings so it just logs a
very not useful <nil>

auth: add Grants.IsSubset

This is a little bit hacky. Previously DecodeGrants would only store the
list of grants associated with the current service. This minimizes API
breakage by storing all grants as $service/$grant in the map key and
stores the local service name in the grant object, and updates
Grants.Has() to accept "$grant" and infer that it refers to a local
service or accept the fully qualified "$service/$grant" to test against
grants for any service -- which IsSubset makes use of to test that one
Grant object is a subset of another with respect to all services it has
grants for.

auth: make DecodeGrants return an error

We'll use this function to validate grants passed in via
builds.sr.ht manifests.

go fmt

Remove %e formatting verbs

%e is not valid for formatting error values:

> %e	scientific notation, e.g. -1.234456e+78

Instead, use %w when using fmt.Errorf (for error wrapping) and
%v when using log.Printf (%w is not valid in that context).

auth: force webhooks to read-only

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

webhooks: initial prototype for GQL-native webhooks

auth: s/OAuth2Token/BearerToken/g

This also makes some tweaks to the organization of the crypto module to
make it easier for us to add more keys in the future, which will be
necessary for the internal token redesign.

Various bug fixes per pages.sr.ht

Add basic auth tests

Import GQL server interfaces from gql.sr.ht