feat: add webhook auth guard and IRC password/username support

Add WEBHOOK_SECRET env var for authenticating incoming Owncast webhooks
via a ?secret= query parameter. Requests with a missing or incorrect
secret are rejected with 401. If unset, all requests are accepted
(with a startup warning).

Also includes previously uncommitted work:
- IRC server password support (IRC_PASSWORD env var, PASS command)
- IRC username/ident field in config
- IRC_PASSWORD and SELinux volume flag in docker-compose.yml

Made-with: Cursor

Cargo.lock

@@ -1127,6 +1127,7 @@ dependencies = [
  "tokio-test",
  "tokio-tungstenite",
  "toml 0.8.23",
+ "tower",
  "tracing",
  "tracing-subscriber",
 ]