auth: add AuthContext.Access

Same logic as server.Access, but lower-level. Useful to check for
a permission not covered by the GraphQL schema @access directives
(such as builds.sr.ht secrets).

server: fix error message on missing grant in Access

The error returned when a token is missing a required grant would
be "Access denied for invalid auth method" which is confusing.
Fix this with a more accurate error message.

server/directives: handle auth.AUTH_ANON_INTERNAL in Access

Allow AUTH_COOKIE to access @private fields

Add @anoninternal support code

This is a slightly better approach to the previous commit.

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

server: add @private directive glue code

webhooks: initial prototype for GQL-native webhooks

Fix bug with internal authentication

Make authorization errors more specific

Import GQL server interfaces from gql.sr.ht