p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification
is ignored. No 502. keys add writes the secret only to --out. Release binary
has no -test-allow-prefix.

vendor/github.com/itchyny/gojq/code.go

@@ -0,0 +1,108 @@
+package gojq
+
+type code struct {
+	v  any
+	op opcode
+}
+
+type opcode int
+
+const (
+	opnop opcode = iota
+	oppush
+	oppop
+	opdup
+	opconst
+	opload
+	opstore
+	opobject
+	opappend
+	opfork
+	opforktrybegin
+	opforktryend
+	opforkalt
+	opforklabel
+	opbacktrack
+	opjump
+	opjumpifnot
+	opindex
+	opindexarray
+	opcall
+	opcallrec
+	oppushpc
+	opcallpc
+	opscope
+	opret
+	opiter
+	opexpbegin
+	opexpend
+	oppathbegin
+	oppathend
+)
+
+func (op opcode) String() string {
+	switch op {
+	case opnop:
+		return "nop"
+	case oppush:
+		return "push"
+	case oppop:
+		return "pop"
+	case opdup:
+		return "dup"
+	case opconst:
+		return "const"
+	case opload:
+		return "load"
+	case opstore:
+		return "store"
+	case opobject:
+		return "object"
+	case opappend:
+		return "append"
+	case opfork:
+		return "fork"
+	case opforktrybegin:
+		return "forktrybegin"
+	case opforktryend:
+		return "forktryend"
+	case opforkalt:
+		return "forkalt"
+	case opforklabel:
+		return "forklabel"
+	case opbacktrack:
+		return "backtrack"
+	case opjump:
+		return "jump"
+	case opjumpifnot:
+		return "jumpifnot"
+	case opindex:
+		return "index"
+	case opindexarray:
+		return "indexarray"
+	case opcall:
+		return "call"
+	case opcallrec:
+		return "callrec"
+	case oppushpc:
+		return "pushpc"
+	case opcallpc:
+		return "callpc"
+	case opscope:
+		return "scope"
+	case opret:
+		return "ret"
+	case opiter:
+		return "iter"
+	case opexpbegin:
+		return "expbegin"
+	case opexpend:
+		return "expend"
+	case oppathbegin:
+		return "pathbegin"
+	case oppathend:
+		return "pathend"
+	default:
+		panic(op)
+	}
+}