server/directives: handle auth.AUTH_ANON_INTERNAL in Access

Allow AUTH_COOKIE to access @private fields

Add @anoninternal support code

This is a slightly better approach to the previous commit.

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

server: add @private directive glue code

webhooks: initial prototype for GQL-native webhooks

Fix bug with internal authentication

Make authorization errors more specific

Import GQL server interfaces from gql.sr.ht