authenticate: make service http only

- Rename SessionState to State to avoid stutter.
- Simplified option validation to use a wrapper function for base64 secrets.
- Removed authenticates grpc code.
- Abstracted logic to load and validate a user's authenticate session.
- Removed instances of url.Parse in favor of urlutil's version.
- proxy: replaces grpc refresh logic with forced deadline advancement.
- internal/sessions: remove rest store; parse authorize header as part of session store.
- proxy: refactor request signer
- sessions: remove extend deadline (fixes #294)
- remove AuthenticateInternalAddr
- remove AuthenticateInternalAddrString
- omit type tag.Key from declaration of vars TagKey* it will be inferred
  from the right-hand side
- remove compatibility package xerrors
- use cloned http.DefaultTransport as base transport

internal/cryptutil/sign_test.go

@@ -1,11 +1,12 @@
 package cryptutil // import "github.com/pomerium/pomerium/internal/cryptutil"
 
 import (
+	"encoding/base64"
 	"testing"
 )
 
 func TestES256Signer(t *testing.T) {
-	signer, err := NewES256Signer([]byte(pemECPrivateKeyP256), "destination-url")
+	signer, err := NewES256Signer(base64.StdEncoding.EncodeToString([]byte(pemECPrivateKeyP256)), "destination-url")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -25,12 +26,13 @@ func TestNewES256Signer(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name     string
-		privKey  []byte
+		privKey  string
 		audience string
 		wantErr  bool
 	}{
-		{"working example", []byte(pemECPrivateKeyP256), "some-domain.com", false},
-		{"bad private key", []byte(garbagePEM), "some-domain.com", true},
+		{"working example", base64.StdEncoding.EncodeToString([]byte(pemECPrivateKeyP256)), "some-domain.com", false},
+		{"bad private key", base64.StdEncoding.EncodeToString([]byte(garbagePEM)), "some-domain.com", true},
+		{"bad base64 key", garbagePEM, "some-domain.com", true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {