p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification
is ignored. No 502. keys add writes the secret only to --out. Release binary
has no -test-allow-prefix.

flake.nix

@@ -32,7 +32,7 @@
             pname = "sift";
             inherit version;
             src = ./.;
-            vendorHash = null;
+            vendorHash = "sha256-byOhTmZTW76qEyv8PyuCtbj2C+nk894nPyuwjhFJqtk=";
             env.CGO_ENABLED = "0";
             ldflags = ldflags;
             subPackages = [ "cmd/sift" ];
@@ -79,6 +79,8 @@
               export GOCACHE=$TMPDIR/go-cache
               export GOPATH=$TMPDIR/go
               export GO111MODULE=on
+              export GOPROXY=off
+              export GOFLAGS=-mod=vendor
               # race detector needs cgo; build stays CGO_ENABLED=0 in packages.sift
               export CGO_ENABLED=1
               make test lint