Refactor auth middleware (#36848)

Principles: let the caller decide what it needs, but not let the
framework (middleware) guess what it should do.

Then a lot of hacky code can be removed. And some FIXMEs can be fixed.

This PR introduces a new kind of middleware: "PreMiddleware", it will be
executed before all other middlewares on the same routing level, then a
route can declare its options for other middlewares.

By the way, allow the workflow badge to be accessed by Basic or OAuth2
auth.

Fixes: https://github.com/go-gitea/gitea/pull/36830
Fixes: https://github.com/go-gitea/gitea/issues/36859

modules/web/routing/context.go

@@ -44,7 +44,7 @@ func MarkLongPolling(resp http.ResponseWriter, req *http.Request) {
 }
 
 // UpdatePanicError updates a context's error info, a panic may be recovered by other middlewares, but we still need to know that.
-func UpdatePanicError(ctx context.Context, err any) {
+func UpdatePanicError(ctx context.Context, err error) {
 	record, ok := ctx.Value(contextKey).(*requestRecord)
 	if !ok {
 		return

modules/web/routing/logger_manager.go

@@ -5,11 +5,13 @@ package routing
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"sync"
 	"time"
 
 	"code.gitea.io/gitea/modules/graceful"
+	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
 )
 
@@ -99,7 +101,7 @@ func (manager *requestRecordsManager) handler(next http.Handler) http.Handler {
 			localPanicErr := recover()
 			if localPanicErr != nil {
 				record.lock.Lock()
-				record.panicError = localPanicErr
+				record.panicError = fmt.Errorf("%v\n%s", localPanicErr, log.Stack(2))
 				record.lock.Unlock()
 			}
 

modules/web/routing/requestrecord.go

@@ -24,5 +24,5 @@ type requestRecord struct {
 	// mutable fields
 	isLongPolling bool
 	funcInfo      *FuncInfo
-	panicError    any
+	panicError    error
 }