p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification
is ignored. No 502. keys add writes the secret only to --out. Release binary
has no -test-allow-prefix.

internal/auth/auth_test.go

@@ -0,0 +1,52 @@
+package auth
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestAddLookupRevoke(t *testing.T) {
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "keys.toml")
+	out := filepath.Join(dir, "k")
+	if err := Add(keys, "talos", "hermes-fleet", out); err != nil {
+		t.Fatal(err)
+	}
+	st, err := os.Stat(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Mode().Perm()&0o077 != 0 {
+		t.Fatalf("perms %v", st.Mode())
+	}
+	b, _ := os.ReadFile(out)
+	key := string(b)
+	if key[len(key)-1] == '\n' {
+		key = key[:len(key)-1]
+	}
+	s, err := Load(keys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.LookupBearer(key) == nil || s.LookupBearer(key).Name != "talos" {
+		t.Fatal("lookup failed")
+	}
+	if s.LookupBearer("nope") != nil {
+		t.Fatal("unknown accepted")
+	}
+	if err := Add(keys, "x", "y", out); err == nil {
+		t.Fatal("overwrite allowed")
+	}
+	cs, err := List(keys)
+	if err != nil || len(cs) != 1 || cs[0].Name != "talos" {
+		t.Fatalf("%v %v", cs, err)
+	}
+	if err := Revoke(keys, "talos"); err != nil {
+		t.Fatal(err)
+	}
+	s, _ = Load(keys)
+	if s.LookupBearer(key) != nil {
+		t.Fatal("revoked still valid")
+	}
+}