internalauth: both ends of the Internal authorization

core-go implements this check unexported inside auth.Middleware, so a
service that wants the guard without the session resolution behind it
writes it again: dolt.sr.ht did, in web/handlers_internal.go, and the
caller minting the header for it is a different program in the same
repository (cmd/dolt-git-hook) that spells the payload out by hand.

Copies drifting is the smaller half. The two ends of one protocol shared
no type, no constant and no test, so a change to the payload shape, the
scheme or the expiry breaks nothing at build time and stops provisioning
at the next push. They are two functions over one struct here.

The check stays core-go's: source address inside [sr.ht]internal-ipnet
AND a fernet token sealed with [sr.ht]network-key, at most 30s old, both
required. Three deliberate departures. The caller may be pinned to a
client and node id, which upstream only checks are non-empty; a payload
that decrypts but is not an internal auth is a 403 rather than a panic,
as is a RemoteAddr that does not parse; and the refusals are sentinels,
so "not internal at all" is distinguishable from "internal but wrong
client" without parsing an error string.