auth: add /query/external/* to anonymous whitelist

auth/middleware: make auth scheme case-insensitive

According to RFC 7235 section 2.1, the auth scheme is
case-insensitive.

auth: fix invalid json tag in InternalAuth

auth: Use canonical user IDs

When adding users to the database, use the canonical user ID from
meta.sr.ht.

Revert "auth: Use canonical user IDs"

This reverts commit 6c1036e2705d93e1cb71476ac78499ae27f0d326.

auth: Use canonical user IDs

When adding users to the database, use the canonical user ID from
meta.sr.ht.

Fix (some) user PGP key lookups from meta.sr.ht

The authForUsername() function uses a closure that is almost identical
to the LookupUser() function, but is missing the handling for the PGP
key if called from meta.sr.ht. This causes at least the email
notifications for new OAuth2 tokens to be sent unencrypted. This commit
fixes that (and reduces code duplication) by calling LookupUser()
instead.

This requires the context for the tests to have a value for the calling
service, so add that to the mock.

go fmt

auth: fix nil reference in auth method check

Add @anoninternal support code

This is a slightly better approach to the previous commit.

auth: implement internal anonymous authentication

This is used for meta.sr.ht's GraphQL user registration resolver, which
needs to run prior to the user's information being added to the database.

go fmt

Fix json struct tag

Found via `go vet`:

    auth/middleware.go:259:2: struct field tag `json:"oauth_client_id",omit-empty` not compatible with reflect.StructTag.Get: key:"value" pairs not separated by spaces

Remove %e formatting verbs

%e is not valid for formatting error values:

> %e	scientific notation, e.g. -1.234456e+78

Instead, use %w when using fmt.Errorf (for error wrapping) and
%v when using log.Printf (%w is not valid in that context).

auth: improve error response format

This maps more closely onto what normal GQL errors look like.

auth: force webhooks to read-only

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

webhooks: expand auth configuration

The purpose of this change is to enable internal webhooks to be
configured in GQL webhook tables. A webhook subscription now includes
the auth method field which is appropriate, which is limited to either
OAUTH2 or INTERNAL. In the former case, the previous set of fields will
be valid, and in the latter case, the NodeID field will be valid. This
will allow us to register webhook subscriptions for internal use.

auth: fix /query/api-meta.json route

This route does not need authentication.

webhooks: initial prototype for GQL-native webhooks