api: add base admin API key support

[mastercactapus]

Description:
This PR introduces the ability to create, delete, and use admin-only API keys for the GraphQL API.

This functionality is behind the experimental flag gql-api-keys.

make start EXPERIMENTAL=gql-api-keys

Which issue(s) this PR fixes:
Part of #3007

Out of Scope:

• Policy caching (perf. optimization) will be done in a separate PR
• Update and listing will be done in a separate PR, this is just base functionality
• UI for managing and viewing usage will be done in a separate PR

Describe any introduced API changes:

• createGQLAPIKey and deleteGQLAPIKey mutations were added

Additional Context
Since this is a large PR, here's a walkthrough of the changes:

• There are context helpers for storing/retrieving the API key policy from a request
• The tokens themselves are JWT, with expiration and an embedded hash of the policy (prevents policy changes after token generation)
• last-used data is kept for each key and includes the user agent and IP address
• the policy for a key includes all allowed GraphQL fields, as well as the role (Admin or User)
• policy info is stored in the DB, the hash must match the embedded hash of the token
• sqlc was used for all DB queries
• this PR supports Delete, Authorize, and Create
• Keys are only valid for /api/graphql and the GQLAPIKey experimental flag must be enabled
• Field enforcement is done as AroundFields moddleware
• schema has the 2 mutations added (create/delete), creating a key is the only way to retrieve it's token
• The key information is stored in a gql_api_keys table, with soft-deletes
• The usage information is a separate gql_api_key_usage table, since it will receive frequent updates

[andrewbenington]

looks good and seems to work well locally

[andrewbenington]

looks like expflag.d.ts and schema.d.ts are out of date, running go generate ./web/src updated them for me