bearer: silence the std logger the benchmarks were timing

sr-ht-core's auth.DecodeBearerToken calls log.Printf on every token it
refuses, so BenchmarkValidate/invalid wrote one line per iteration. The cost
was not the file: log.Printf takes a mutex, and the case reported 925 ns/op
where the work is 92.5.

The file was a hazard too. An unfiltered run of this package produced 9.5
million lines and 901 MB, and benchfmt skips what it cannot parse — so
bench.sr.ht would have accepted that upload and reported success over it.

Ignore cover.out and bench.txt: make cover and make bench write them into
the checkout.

benchmarks for the hot path

Twenty-nine of them, over what every request of every service actually
touches: working-token validation, grant parsing and matching, the chi and
net/http middleware, and the same-origin guard.

They exist to be uploaded. This library had no CI and no benchmarks at all
while seven services pin it, so nothing measured a regression here.