Refactor auth middleware (#36848)

Principles: let the caller decide what it needs, but not let the
framework (middleware) guess what it should do.

Then a lot of hacky code can be removed. And some FIXMEs can be fixed.

This PR introduces a new kind of middleware: "PreMiddleware", it will be
executed before all other middlewares on the same routing level, then a
route can declare its options for other middlewares.

By the way, allow the workflow badge to be accessed by Basic or OAuth2
auth.

Fixes: https://github.com/go-gitea/gitea/pull/36830
Fixes: https://github.com/go-gitea/gitea/issues/36859

routers/common/errpage_test.go

@@ -22,7 +22,7 @@ func TestRenderPanicErrorPage(t *testing.T) {
 		w := httptest.NewRecorder()
 		req := &http.Request{URL: &url.URL{}, Header: http.Header{"Accept": []string{"text/html"}}}
 		req = req.WithContext(reqctx.NewRequestContextForTest(t.Context()))
-		RenderPanicErrorPage(w, req, errors.New("fake panic error (for test only)"))
+		renderPanicErrorPage(w, req, errors.New("fake panic error (for test only)"))
 		respContent := w.Body.String()
 		assert.Contains(t, respContent, `class="page-content status-page-500"`)
 		assert.Contains(t, respContent, `</html>`)