server: add health endpoint to metrics listener

There are already facilities to run the metrics listener on a fixed
port, so this makes for a useful endpoint to have metrics and a health
check in Kubernetes without exposing them to the world. In the long run,
I would like to remove the metrics endpoint from the public listener,
but that will take more work.

server: setup router dedicated to webhook processing

This introduces a new chi router to allow processing (in Go) webhook
calls coming from other SourceHut services.

It ensures that incoming messages are signed with the webhook private
key and if so, provides access both to the database and service
configuration.

Signed-off-by: Simon Martin <simon@nasilyan.com>

server: support multiple bind addresses

server: support setting build version and date information

This is a pre-requisite to the effort to make this information available
via the GraphQL API.

Co-authored-by: Conrad Hoffmann <ch@bitfehler.net>
Signed-off-by: Simon Martin <simon@nasilyan.com>

server: let AUTH_INTERNAL access @anoninternal

Both methods enforce the internal aspect, but @anoninternal really just
means the resolver does not require an "authenticated user" context,
which means it's still perfectly safe if there is one.

With this in place, any resolver that may have to be called from an
anonymous context can be switched from @internal to @anoninternal
without breaking existing users. Of course it can only be switched if it
really does not require a user context.

server: allow setting ports for metrics, pprof

With an eye towards Kubernetes, it is desirable to avoid having the API
pick random ports for anything. This commit introduces additional flags
for the API server to specify the metrics and pprof ports. This change
is backwards-compatible insofar as the default behavior is preserved if
the flags are not used.

The log output is changed to include the full address that the
respective listeners are listening on.

Note that using "0.0.0.0:1234" might not quite work as expected, because
Go [1]. But that does not change the default behavior, so I guess it's
fine.

[1] https://github.com/golang/go/issues/48723

Don't uppercase error messages

Run modernize

See https://pkg.go.dev/golang.org/x/tools/gopls/internal/analysis/modernize

It's mostly interface{} -> any, but also two quite useful applications
of slices.Contains.

server: add error presenter to make context cancellation semantic

feature: add submodule + middleware for feature flags

Refactor config loading and server initialization

As is, LoadConfig() does some things that are not strictly related to
the configuration, such as parsing command line arguments. This has led
to a proliferation of different ways to load the config based on various
needs and also prevents tools that need a config but are not services to
use custom command line arguments.

This commit aims to decouple config loading from everything else and
do nothing but loading the config files.

On a high level, this commit:
- renames server.NewServer() to server.New()
- moves config.Debug and config.Addr into the server package
- moves crypto.InitCrypto() call into server.New()
- moves command line parsing into server.New(), using passed-in values
  rather than os.Args

The only changes required for services would be changing

   cfg := config.LoadConfig(":5100")
   server := server.NewServer("meta.sr.ht", cfg)

to

   cfg := config.LoadConfig()
   server := server.New("meta.sr.ht", ":5100", cfg, os.Args)

All other tools will be switched to just LoadConfig() and, optionally, a
call to crypto.InitCrypto(). I managed to completely remove some global
state (addr) and at least make the rest private, so that users are
forced to use the designated functions.

The config module gained support for custom FS implementation, mainly
for testing.

server: enable GraphQL introspection

server: log GraphQL queries if running in debug mode

server: handle CORS in server

Currently CORS is handled in nginx in front of the API. That setup is
not very suitable for Kubernetes. Instead, handle CORS here, so we do
not need any intermediaries between the ingress and the APIs.

The CORS settings are taken from sr.ht-nginx/graphql.conf [1]

[1] https://git.sr.ht/~sircmpwn/sr.ht-nginx/tree/master/item/graphql.conf

server: replace deprecated gqlgen code

Most of the gqlgen/handler package, specifically also
`handler.GraphQL()`, has been deprecated [1]. The documentation of the
new package [2] is a bit lacking, but some stuff is covered in the
reference docs [3] [4], and some in the examples [5].

[1] https://pkg.go.dev/github.com/99designs/gqlgen@v0.17.36/handler#GraphQL
[2] https://pkg.go.dev/github.com/99designs/gqlgen@v0.17.36/graphql/handler
[3] https://gqlgen.com/reference/errors/#the-panic-handler
[4] https://gqlgen.com/reference/complexity/#limiting-query-complexity
[5] https://github.com/99designs/gqlgen/blob/master/_examples/fileupload/server/server.go

server: disable logging for release mode

This was partially implemented a while ago but we missed the main point
where it matters.

server: add pprof endpoint

This adds a pprof endpoint to all SourceHut APIs. It picks an
OS-assigned port on localhost to run it on and prints this port to
stdout. This ensures a unique port is selected even if several APIs are
running on a single host.

server: enable request logging only in debug mode

To improve the signal:noise ratio in the production logs.

redis: avoid building UniversalOptions for standard mode

This makes it support all options that go-redis recognizes in ParseURL,
by constructing a standard client directly instead of building
UniversalOptions ourselves.

server/email: print correct var on type assertion failure