webhooks: do not limit webhooks by token_hash

When a user re-authenticates with an OAuth2 app, the app would not be
able to query or delete webhooks it created with a previous session.
This was a problem for a tool I am developing and removing this
constraint fixes the issue.

server: allow setting ports for metrics, pprof

With an eye towards Kubernetes, it is desirable to avoid having the API
pick random ports for anything. This commit introduces additional flags
for the API server to specify the metrics and pprof ports. This change
is backwards-compatible insofar as the default behavior is preserved if
the flags are not used.

The log output is changed to include the full address that the
respective listeners are listening on.

Note that using "0.0.0.0:1234" might not quite work as expected, because
Go [1]. But that does not change the default behavior, so I guess it's
fine.

[1] https://github.com/golang/go/issues/48723

Run golangci-lint in CI

See https://golangci-lint.run

This has already helped uncover some issues, and we should make more use
of it. Currently we have to disable one of the default lints, as we have
a lot of issues it complains about. I plan to address those one by one
and enable it. Until then, put this in place to make sure we don't
re-introduce any of the issues we've eliminated so far.

Don't uppercase error messages

Fix a bunch of linter complaints

webhooks: improve usage of slices.Contains

This was (rightfully) suggested by modernize [1], but the result can be
easily improved even further.

[1] https://pkg.go.dev/golang.org/x/tools/gopls/internal/analysis/modernize

Run modernize

See https://pkg.go.dev/golang.org/x/tools/gopls/internal/analysis/modernize

It's mostly interface{} -> any, but also two quite useful applications
of slices.Contains.

auth/middleware: return semantic errors on auth failure

This time with a much simpler approach than the last one that caused
some authentication issues for chat.sr.ht.

Revert "auth: ensure semantic errors are bubbled up to user properly"

This reverts commit 0936891734e7f92b7ad724caea27715f2e3e7b5c.

gofmt

server: add error presenter to make context cancellation semantic

auth: ensure semantic errors are bubbled up to user properly

auth: add error code on unauthorized request response

auth: handle edge case when fetching users from meta

feature: add submodule + middleware for feature flags

model: introduce ID type

Based on UUIDv7 but represented to users in a more compact base32 form,
though all of that are internal implementation details.

database: add WithReadOnlyTx

Refactor config loading and server initialization

As is, LoadConfig() does some things that are not strictly related to
the configuration, such as parsing command line arguments. This has led
to a proliferation of different ways to load the config based on various
needs and also prevents tools that need a config but are not services to
use custom command line arguments.

This commit aims to decouple config loading from everything else and
do nothing but loading the config files.

On a high level, this commit:
- renames server.NewServer() to server.New()
- moves config.Debug and config.Addr into the server package
- moves crypto.InitCrypto() call into server.New()
- moves command line parsing into server.New(), using passed-in values
  rather than os.Args

The only changes required for services would be changing

   cfg := config.LoadConfig(":5100")
   server := server.NewServer("meta.sr.ht", cfg)

to

   cfg := config.LoadConfig()
   server := server.New("meta.sr.ht", ":5100", cfg, os.Args)

All other tools will be switched to just LoadConfig() and, optionally, a
call to crypto.InitCrypto(). I managed to completely remove some global
state (addr) and at least make the rest private, so that users are
forced to use the designated functions.

The config module gained support for custom FS implementation, mainly
for testing.

objects: bring back support for plain HTTP

This got lost during the transition from minio to S3 client.

client: improve user agent