auth: update user type constants

Those need to be kept in sync with the database/GraphQL values. The ones
not in sync are not currently used, though.

server: let AUTH_INTERNAL access @anoninternal

Both methods enforce the internal aspect, but @anoninternal really just
means the resolver does not require an "authenticated user" context,
which means it's still perfectly safe if there is one.

With this in place, any resolver that may have to be called from an
anonymous context can be switched from @internal to @anoninternal
without breaking existing users. Of course it can only be switched if it
really does not require a user context.

Don't uppercase error messages

Fix a bunch of linter complaints

Run modernize

See https://pkg.go.dev/golang.org/x/tools/gopls/internal/analysis/modernize

It's mostly interface{} -> any, but also two quite useful applications
of slices.Contains.

auth/middleware: return semantic errors on auth failure

This time with a much simpler approach than the last one that caused
some authentication issues for chat.sr.ht.

Revert "auth: ensure semantic errors are bubbled up to user properly"

This reverts commit 0936891734e7f92b7ad724caea27715f2e3e7b5c.

auth: ensure semantic errors are bubbled up to user properly

auth: add error code on unauthorized request response

auth: handle edge case when fetching users from meta

Refactor config loading and server initialization

As is, LoadConfig() does some things that are not strictly related to
the configuration, such as parsing command line arguments. This has led
to a proliferation of different ways to load the config based on various
needs and also prevents tools that need a config but are not services to
use custom command line arguments.

This commit aims to decouple config loading from everything else and
do nothing but loading the config files.

On a high level, this commit:
- renames server.NewServer() to server.New()
- moves config.Debug and config.Addr into the server package
- moves crypto.InitCrypto() call into server.New()
- moves command line parsing into server.New(), using passed-in values
  rather than os.Args

The only changes required for services would be changing

   cfg := config.LoadConfig(":5100")
   server := server.NewServer("meta.sr.ht", cfg)

to

   cfg := config.LoadConfig()
   server := server.New("meta.sr.ht", ":5100", cfg, os.Args)

All other tools will be switched to just LoadConfig() and, optionally, a
call to crypto.InitCrypto(). I managed to completely remove some global
state (addr) and at least make the rest private, so that users are
forced to use the designated functions.

The config module gained support for custom FS implementation, mainly
for testing.

Don't prevent suspended users from authenticating

With cookies or internal auth. The frontends already prevent users from
accessing services while suspended, and there are some complications if
we don't let the frontends access the backends at all if the
authenticated user is suspended.

auth: remove legacy OAuth support

auth/bearer: log username associated with expired token

auth: fix remote IP determination for audit log

This is probably isolated to dev or other small environments, but I had
two issues with the remote IP determination, breaking the audit log
display in my dev env after fairly standard usage.

The gist is that the audit log is designed to contain clean IP addresses
only. However, the algorithm starts out with `r.RemoteAddr`, which may
contain a port (usually 127.0.0.1:xxxxx). The port removal is already
performed at the beginning of the function, so simply re-use the result
of this.

Furthermore, the initial value (containing the port leading to breakage)
landed in the audit log because I was using a private IP (it's my dev
evn). We correctly trust private IPs, but that means if no public IP
ever shows up in the X-Forwarded-For header, the last private IP was the
one that actually made the request.

I am not entirely sure why this showed up now. I already had a bunch of
oder audit log entries that had the correct private-but-not-localhost
addresses. But in the current state, e.g. simply updating my profile
would cause the bad IP:port notation to be written to the audit log.

auth: fix middleware tests

They got broken with 6eae2199 because the tests cannot use
`config.LoadConfig`, so the list of internal IP nets never gets
populated.

webhooks: implement internal webhook users

AUTH_INTERNAL requests previously could not register webhooks. This
commit adds the necessary changes to allow for this.

all: pass errors to panic, not strings

GraphQL's recovery middleware can't handle strings so it just logs a
very not useful <nil>

auth: use config.IsInternalIP

auth: reduce scope of user_type