ci: test, coverage and benchmarks on builds.sr.ht

This repository had no CI while seven services pinned it, so a break here
was discovered in whichever service next ran `go get -u`. The manifest is
the sibling services' pipeline with everything only a service needs taken
out: no scss, no keygen, no abuild, no publish, no publish_artifacts, and
no postgres — nothing in this module imports database/sql, no test opens a
database and no test skips on a missing DSN. What is left is the Go cache,
the gates, the two runs and the two uploads to cov.srht.bigb.es and
bench.srht.bigb.es.

The Makefile is what the manifest calls, so the Go command lines exist
once. Its bench target filters its own output, and that is not tidiness:
`go test` merges the test binary's stderr into stdout, bearer's
invalid-token benchmark makes sr-ht-core's auth.DecodeBearerToken log once
per iteration, and an unfiltered BENCH_COUNT=10 run was 901 MB and 9.5
million lines deep — around the 290 result lines it produces — when it was
stopped. benchfmt ignores what it cannot parse, so that file would have
uploaded "successfully". Filtered, the same run is 340 lines and 31 KB.
The cure belongs in the benchmark, which should silence the logger the way
middleware's discardLog already does; the filter is the pipeline's defence
either way.

check-fmt and not gofmt, because `gofmt -l` prints the offending files and
still exits 0; cover refuses an empty profile and the bench task greps for
one benchmark name per benchmark file, because both would otherwise upload
nothing and call it a success.