feat: Message Authentication

[tommoor]

This PR adds token based authentication over the websocket, this replaces the current solution of using query parameters which can easily end up in logs and "bakes in" the concept of authentication and authorization more clearly.

Docs are updated, but the main interface differences are as so:

• HocuspocusProvider gains a token option to pass an auth/access token to the server (or any other string-based authentication you might have).
• Server gains an optional "onAuthenticate" hook, this acts much like onConnect before, but instead of accessing the query parameters object it is passed the token from the client. If the hook is not provided then no authentication is required.

Of note:

• Sync messages can be sent down the socket before authentication is completed, they will be queued on the server.
• Messages can also arrive in any order, so that's nice for resiliency – with this solution the authentication message doesn't even have to be first.
• If auth fails the provider will disconnect and not retry automatically, it's upto the implementation to decide how to deal with this situation.

closes #109
closes yjs/y-websocket#67

[hanspagel]

Amazing PR! I’ve added some happy path tests, and left some comments. ✌️

Oh, and I had to research it, but Drafts are a premium feature for private repositories.

[hanspagel]

Thanks for the update!

[hanspagel]

Released as @hocuspocus/[email protected] 🎉

Thanks for your work on this, this was really a superb contribution!