auth: fix middleware tests

They got broken with 6eae2199 because the tests cannot use
`config.LoadConfig`, so the list of internal IP nets never gets
populated.

webhooks: implement internal webhook users

AUTH_INTERNAL requests previously could not register webhooks. This
commit adds the necessary changes to allow for this.

all: pass errors to panic, not strings

GraphQL's recovery middleware can't handle strings so it just logs a
very not useful <nil>

auth: use config.IsInternalIP

auth: reduce scope of user_type

auth: grant scoped access to anon internal auth

Internal auth is granted access to everything, whereas anonymous
internal auth is pretty restricted. This is mostly to avoid accidentally
hitting resolvers that require a logged-in user, however. Given that all
anon internal use cases are hard-coded and tested, this seems like a
pretty low risk. Allowing this will have the huge benefit of making much
more information available to anon internal queries, which will unlock
removing a bunch of awkward work-arounds we put in place.

Note, however, that this is also a work-around. It saves us from adding
yet more work-arounds to the GQL schema, and in the meantime a redesign
of the schema (especially the directives) is being worked on.

auth/middleware: fix user_type on new users

auth/middleware: convert user types to uppercase

auth: add Grants.IsSubset

This is a little bit hacky. Previously DecodeGrants would only store the
list of grants associated with the current service. This minimizes API
breakage by storing all grants as $service/$grant in the map key and
stores the local service name in the grant object, and updates
Grants.Has() to accept "$grant" and infer that it refers to a local
service or accept the fully qualified "$service/$grant" to test against
grants for any service -- which IsSubset makes use of to test that one
Grant object is a subset of another with respect to all services it has
grants for.

server: use routing groups

Instead of hardcoding some exceptions in the auth middleware, use a
different routing group for routes that do not require auth. Makes the
auth middleware more generic and also removes a lot of unneccessary
middleware processing from routes that don't need it.

For now, the added group is not accessible from outside the module, but
if the need arises, this might be an option.

auth: add auth.IPAddress

With support for X-Forwarded-For

auth/middleware: set WWW-Authenticate header field

See RFC 6750 section 3.

client: rename Execute to Do

583d0b1bcb08 ("client/graphql: handle GraphQL errors") changed
Execute behavior by wrapping the result into a struct with "data"
and "errors" fields. This is a breaking change, but it's hard to
spot when upgrading core-go because it won't cause a compilation
error.

Rename Execute to Do to break the build and force callers to update
accordingly.

auth: add RequireMiddleware

Same as Middleware, but requires auth for all requests. Will be
useful to drop hacks from pages.sr.ht.

Drop gqlparser v1 dependency

Only use v2 throughout the repository.

auth: make DecodeGrants return an error

We'll use this function to validate grants passed in via
builds.sr.ht manifests.

auth: add AuthContext.Access

Same logic as server.Access, but lower-level. Useful to check for
a permission not covered by the GraphQL schema @access directives
(such as builds.sr.ht secrets).

auth: add /query/external/* to anonymous whitelist

auth/middleware: make auth scheme case-insensitive

According to RFC 7235 section 2.1, the auth scheme is
case-insensitive.

auth: fix invalid json tag in InternalAuth