p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification
is ignored. No 502. keys add writes the secret only to --out. Release binary
has no -test-allow-prefix.

vendor/github.com/itchyny/gojq/Dockerfile

@@ -0,0 +1,14 @@
+FROM golang:1.26 AS builder
+
+WORKDIR /app
+COPY go.* ./
+RUN go mod download
+COPY . .
+ENV CGO_ENABLED=0
+RUN make build
+
+FROM gcr.io/distroless/static:debug
+
+COPY --from=builder /app/gojq /
+ENTRYPOINT ["/gojq"]
+CMD ["--help"]