Auth fetch verification (cavage) works now

- Verifying inbound requests signed with Cavage are now checked as
  expected
- Fixed a bug where the signature header is not generated correctly
- Extended config to include settings for what requests to verify
- Fixed new server in main not using internal port from config

devserver/linstrom.toml

@@ -11,6 +11,8 @@
   first_time_setup_otp = "Example otp password"
   profiling_password = ""
   allow_registration = true
+  auth_fetch_for_get = false
+  auth_fetch_for_non_get = true
 
 [webauthn]
   display_name = "Linstrom"
@@ -47,3 +49,4 @@
 
 [experimental]
   use_ed25519_keys = false
+  auth_fetch_for_server_actor = false