Wrap only webhandler with authentication

Currently auth wraps all handlers if `publiclyViewable` is set to false.
This prevents `turbine` from hitting the callback URLs seeming that the
build never starts or return any result.

Now we wrap only the web handler with auth since the api and callback
handlers have their own authentication.

[#80964318]
Merge pull request #1 from luan/fix-publicly-visible-bug

Turbine can't talk to callback URLs
build logs are stored in an events table

...rather than one gigantic column. there's a tricky migration here, but
it should be self-contained at least.

[#80512764]
zero-prefix migration files
switch to server-sent events for all build logs

* the scheduling ATC is now responsible for tracking each running build,
  by consuming events from its Turbine endpoint
* remove callbacks endpoints; they are no longer used
* in-flight builds proxy events to their turbine; completed builds read
  events from the database
* remove logfanout and a bunch of no-longer-relevant code
* if a running build's turbine reports 404, mark the build as errored

[#72547842] [#80512764] [#80649160]
correct events migration, migrate guid/endpoint
fix event log censoring; better 1.1/1.0 handling

[#80512764]
make events migration more durable

now handles version events mixed in with build events

[#80512764]
fix hijack endpoint not proxying request body
improve logging
track more asynchronously from scheduler
correct output saving

* save outputs only after build succeeds
* save implicit outputs

[#81086754]
add a bunch of logging to tracker
moar debugging
debug -> info for now
don't leak build events response body
don't leak event response body
track input resource along with its name

...use the resource to save the version, not the name, which may be
configured independently

[#81142344]
fix censoring test
fall back on input name if resource is not present

i.e. if a build is in-flight before the upgrade