feat: optional cookies for basicauth

[Lemmmy]

adds optional configuration for storing basicauth in a cookie, since browsers only store it for session lifetime. there's probably something to be said about the security of this, but i don't think it's really any less than basicauth itself is, or cookies in general. by default the cookies will refresh on half TTL (to avoid set-cookie spam and races), which is why there's an additional timestamp cookie stored. of course the user can tamper with this value, so there's no expectation of serverside enforcement of TTLs here. if the user's cookies are exfiltrated then they have bigger problems. if the sitemaster needs more security, then they should look at other auth solutions imo

configuration:

basicauth / username password {
  # default TTL 24h
  cookie
}

basicauth / username password {
  cookie {
    ttl 8760h # custom TTL
    refresh 168h # optional
  }
}

basicauth / username password {
  cookie {
    ttl 24h
    refresh 0 # never refresh
    name foo # custom cookie name
  }
}