Auth fetch verification (cavage) works now

- Verifying inbound requests signed with Cavage are now checked as
  expected
- Fixed a bug where the signature header is not generated correctly
- Extended config to include settings for what requests to verify
- Fixed new server in main not using internal port from config

web/public/api/api.go

@@ -6,6 +6,7 @@ import (
 
 	webutils "git.mstar.dev/mstar/goutils/http"
 
+	"git.mstar.dev/mstar/linstrom/config"
 	"git.mstar.dev/mstar/linstrom/web/public/api/activitypub"
 	webmiddleware "git.mstar.dev/mstar/linstrom/web/public/middleware"
 )
@@ -18,7 +19,10 @@ func BuildApiRouter() http.Handler {
 			"/activitypub",
 			webutils.ChainMiddlewares(
 				activitypub.BuildActivitypubRouter(),
-				webmiddleware.BuildAuthorizedFetchCheck(true, true),
+				webmiddleware.BuildAuthorizedFetchCheck(
+					config.GlobalConfig.Admin.AuthFetchForNonGet,
+					config.GlobalConfig.Admin.AuthFetchForGet,
+				),
 			),
 		),
 	)