auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

server: add @private directive glue code

webhooks: initial prototype for GQL-native webhooks

Fix bug with internal authentication

Make authorization errors more specific

Import GQL server interfaces from gql.sr.ht