Refactor auth code

[Turbo87]

Up until this point our "auth" code was scattered all over the place and mixed up authentication (who are you?) and authorization (what are you allowed to do?) in multiple places:

• Whether a user account was locked was checked as part of authentication, although it is more of an authorization concern.
• Whether a user has a verified email address was checked in the individual endpoints, if at all.
• Whether a user is an admin was also checked in the individual endpoints that were adjusted to support admin users.
• Whether a user is an owner (or team member) of a crate was also checked in the individual endpoints, in various different ways.
• Whether an API token has the right scopes was also checked as part of authentication, but it is an authorization concern.

This commit centralizes these checks with a three step approach:

1. In the first step the endpoint uses one of the Credentials structs as an axum request extractor to extract the raw credentials from the request metadata (user ID from session cookie, API token, Trusted Publishing token).
2. The credentials are used to look up a corresponding user (or Trusted Publishing token) from the database.
3. The authenticated entity is used to check for authorization of the requested operation.

The second and third step are folded into one fn call (.validate(permission)) to make it harder to use an authenticated entity without knowing if they are authorized for the operation.

While the auth code and the endpoints have changed quite a bit due to this refactoring, the test code is mostly the same except for a few minor details caused by using the request extractors now.

[Turbo87]

@rust-lang/crates-io I've opened this as a draft since I'm mostly looking for feedback on this idea. Please take a look and let me know if this is actually an improvement or not. I'm a little worried that I've over-complicated it, but I'm not quite sure if it can be simplified in a significant way.