Remove %e formatting verbs

%e is not valid for formatting error values:

> %e	scientific notation, e.g. -1.234456e+78

Instead, use %w when using fmt.Errorf (for error wrapping) and
%v when using log.Printf (%w is not valid in that context).

auth: improve error response format

This maps more closely onto what normal GQL errors look like.

auth: force webhooks to read-only

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

webhooks: expand auth configuration

The purpose of this change is to enable internal webhooks to be
configured in GQL webhook tables. A webhook subscription now includes
the auth method field which is appropriate, which is limited to either
OAUTH2 or INTERNAL. In the former case, the previous set of fields will
be valid, and in the latter case, the NodeID field will be valid. This
will allow us to register webhook subscriptions for internal use.

auth: fix /query/api-meta.json route

This route does not need authentication.

webhooks: initial prototype for GQL-native webhooks

auth: s/OAuth2Token/BearerToken/g

This also makes some tweaks to the organization of the crypto module to
make it easier for us to add more keys in the future, which will be
necessary for the internal token redesign.

auth: allow /query/metrics w/o authentication

auth: fix user type on database insert

auth: authenticate all requests under /query

Various bug fixes per pages.sr.ht

crypto: harden API surface

Make it explicit that expiration is not being tested with Decrypt, and
test that the expiration is meaningful with DecryptWithExpiration.

Fetch user PGP key for meta.sr.ht

Correct TODO for context which is invariant

Prohibit OAuth client auth for revoked clients

Print IP with "invalid source IP" authError

Add legacy webhooks worker implementation

Add test for internal auth

auth/middleware_test: test invalid auth cookie