Add verification for the Authorization header for incoming requests. The
defaults are to verify that the request is appropriately authenticated
with a Google service account corresponding to the API Gateway.

Expected issuer, authorised parties, issuer certificate URLs, etc can be
customised via settings. This is unlikely to be used in production but
is useful when combined with the API Gateway emulator for local
development.

Verification can be disabled entirely by setting an appropriately
dire-named setting.

Tests have been updated to exercise verification assuming that the
Google verification library works as documented.

Closes #4

This commit changes no functionality but add pre-commit checks based on
our usual template and fixes up the code to match. Note that this found
a real bug in the type annotation for the override_permissions_spec
decorator.

Port packaging to poetry. This does not make any changes to the existing
test matrix or requirements.