Update ProtonMail/go-crypto to v1.3.0

Add sourcehut-migrate, a unified DB migration tool

This tool will replace both the old `srht-migrate` as well as all
`<SERVICE>-migrate` tools, but services need to be migrated over to it
one by one. This tool is based on brant [1].

Invocation in both production and development can be as simple as:

    sourcehut-migrate <SERVICE> up

The tool will read a config like a regular service (first in ., then
/etc/sr.ht, etc.). The database connection details are taken from the
config. To facilitate development, the tool will check if a folder
./migrations exists; if it does, migrations will be loaded from there.
If no ./migrations folder was found, it will look for migrations in
`<ASSETS>/migrations/<SERVICE>`, where <ASSETS> is also taken from the
config, with a default of `/usr/share/sourcehut`.

For an explanation of the available commands, see brant [1].

This tool also supports a simple command to initialize a newly created
database to the current version (much like the `<SERVICE>-initdb` tools
used to):

    sourcehut-migrate <SERVICE> stamp head

will automatically set the database version to whatever the latest
available migration version is.

[1]: https://git.sr.ht/~bitfehler/brant

server: disable logging for release mode

This was partially implemented a while ago but we missed the main point
where it matters.

config: add GetBool convenience method

It's the boolean equivalent of `GetInt()`. The value handling is taken
from the Python version (`srht.config.cfgb()`).

config: add missing private ip ranges

I noticed that 172.16.0.0/12 is missing from the default private IP
address space; following a quick discussion in [1], this patches adds
it, as well as link local ranges.

[1] https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C20241218140750.2393901-1-robin@jarry.cc%3E

Fixes: deb699c9d01a ("add global internal-ipnet setting")
Signed-off-by: Simon Martin <simon@nasilyan.com>

errors: Fix ErrUnsupported error code

errors.Field: return the error

server: add pprof endpoint

This adds a pprof endpoint to all SourceHut APIs. It picks an
OS-assigned port on localhost to run it on and prints this port to
stdout. This ensures a unique port is selected even if several APIs are
running on a single host.

client: make InternalAuth.Name omitempty to allow @anoninternal auth

In service of
https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C5webr4rzb2eulturkipecdkwms6m7kk2yzafse4p7jybaoknzz@tarta.nabijaczleweli.xyz%3E#%3C56tsvmov5pbxdinyz22rsiq4xzg2k47egmkgdj64fegphk2kvf@tarta.nabijaczleweli.xyz%3E

Allow unix scheme for redis url

Recently, the logic for creating redis client
has been changed and mistakenly unix scheme
has been removed from supported schemes.

errors: add ERR_UNSUPPORTED

server: enable request logging only in debug mode

To improve the signal:noise ratio in the production logs.

errors: new module for common GQL errors

This package provides a means of creating GraphQL-aware errors and
a location for common error codes.

email/worker: catch some PGP error earlier

The writer returned by pgpmail.Encryption() will have the keyring
parsed, but it only tries to determine the encryption key once it is
being written to. Hence, certain errors will only occur later on, when
it is too late to fall back to unencrypted email.

Catch these errors earlier by checking if a valid encryption key is
found.

redis: avoid building UniversalOptions for standard mode

This makes it support all options that go-redis recognizes in ParseURL,
by constructing a standard client directly instead of building
UniversalOptions ourselves.

auth: fix middleware tests

They got broken with 6eae2199 because the tests cannot use
`config.LoadConfig`, so the list of internal IP nets never gets
populated.

server/email: print correct var on type assertion failure

webhooks: fix filter for internal auth

Export webhooks public key via api-meta.json

webhooks: implement internal webhook users

AUTH_INTERNAL requests previously could not register webhooks. This
commit adds the necessary changes to allow for this.