feat: add webhook auth guard and IRC password/username support

Add WEBHOOK_SECRET env var for authenticating incoming Owncast webhooks
via a ?secret= query parameter. Requests with a missing or incorrect
secret are rejected with 401. If unset, all requests are accepted
(with a startup warning).

Also includes previously uncommitted work:
- IRC server password support (IRC_PASSWORD env var, PASS command)
- IRC username/ident field in config
- IRC_PASSWORD and SELinux volume flag in docker-compose.yml

Made-with: Cursor

docker-compose.yml

@@ -5,8 +5,10 @@ services:
     restart: unless-stopped
     environment:
       - OWNCAST_ACCESS_TOKEN=${OWNCAST_ACCESS_TOKEN}
+      - IRC_PASSWORD=${IRC_PASSWORD}
+      - WEBHOOK_SECRET=${WEBHOOK_SECRET}
       - RUST_LOG=info
     volumes:
-      - ./config.toml:/etc/owncast-irc-bridge/config.toml:ro
+      - ./config.toml:/etc/owncast-irc-bridge/config.toml:ro,z
     ports:
       - "9078:9078"