Allow AUTH_COOKIE to access @private fields

auth: fix nil reference in auth method check

Add @anoninternal support code

This is a slightly better approach to the previous commit.

webhooks: fix failing test

auth: implement internal anonymous authentication

This is used for meta.sr.ht's GraphQL user registration resolver, which
needs to run prior to the user's information being added to the database.

server/email: handle errors out of GQL context

webhooks/legacy: fetch subscriptions upfront

This fixes a race condition when delivering webhooks for resource
deletion events, in which the subscriptions would be removed from the
delete cascade before the task to fetch them executes. This requires the
downstream code to call Queue before committing the delete transaction,
and updates the API to include a context argument for the connection
pool.

server/email: include variables

server: move auth middlware ahead of RealIP

So that @internal auth can correctly test against internal-ipnet.

valid: fix nil values in OptionalString

valid: add generic optional interface

go fmt

Fix json struct tag

Found via `go vet`:

    auth/middleware.go:259:2: struct field tag `json:"oauth_client_id",omit-empty` not compatible with reflect.StructTag.Get: key:"value" pairs not separated by spaces

Remove %e formatting verbs

%e is not valid for formatting error values:

> %e	scientific notation, e.g. -1.234456e+78

Instead, use %w when using fmt.Errorf (for error wrapping) and
%v when using log.Printf (%w is not valid in that context).

auth: improve error response format

This maps more closely onto what normal GQL errors look like.

auth: force webhooks to read-only

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

(*WebhookQueue).deliverPayload: address error nit

This return does not need to be here.

webhooks: add comment clarifying field usage

webhooks: expand auth configuration

The purpose of this change is to enable internal webhooks to be
configured in GQL webhook tables. A webhook subscription now includes
the auth method field which is appropriate, which is limited to either
OAUTH2 or INTERNAL. In the former case, the previous set of fields will
be valid, and in the latter case, the NodeID field will be valid. This
will allow us to register webhook subscriptions for internal use.