auth: make DecodeGrants return an error

We'll use this function to validate grants passed in via
builds.sr.ht manifests.

go fmt

Remove %e formatting verbs

%e is not valid for formatting error values:

> %e	scientific notation, e.g. -1.234456e+78

Instead, use %w when using fmt.Errorf (for error wrapping) and
%v when using log.Printf (%w is not valid in that context).

auth: force webhooks to read-only

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

webhooks: initial prototype for GQL-native webhooks

auth: s/OAuth2Token/BearerToken/g

This also makes some tweaks to the organization of the crypto module to
make it easier for us to add more keys in the future, which will be
necessary for the internal token redesign.

Various bug fixes per pages.sr.ht

Add basic auth tests

Import GQL server interfaces from gql.sr.ht