Clean up the logic and add some examples for X509 cert auth with
impersonation proxies.  Fully implement the corresponding unit tests.

Make the event view 403 pages more specific (for event views only),
but more generalized (standard message in the template, not taken
from the context).  Also fix up some unit tests which expected the
old behavior.

New API backend which gets a full X509 certificate, verifies it,
and extracts the subject.  To be used in the cloud deployment
with Traefik.

Move a number of scripts which were managed in a separate repo
into management commands.  This way they can be more easily executed
either manually or by cron jobs.

Add some information to VOEvents and rearrange some things:
  * Add EM Bright information (BNS, NSBH, BBH, Terrestrial) in a
    Group in the What section
  * Put ProbHasNS and ProbHasRemnant in a Group and rename to 'HasNS'
    and 'HasRemnant'

See https://git.ligo.org/lscsoft/gracedb/issues/77

Change the Retraction field to be an int (rather than a bool)
to match other "flag-type" parameters.

Since we only have one API endpoint now, we only need one skymap
URL in a VOEvent, rather than three.

Also removes need for pylal, which is no longer available.

Fixing two migrations
  - ligoauth 0004: properly delete User instance for gstlal-spiir-gpu,
    not just LocalUser/RobotUser
  - ligoauth 0013: deleted, since gstlal-spiir-gpu has been deleted,
    we don't need to create a RobotUser instance for it

Restrict access to RSS feeds to internal users

superevent_id is now always default superevent ID (SXXXXXXa),
while a new 'gw_id' field is either None or the GW ID.
We also add the 'far' field which is just the preferred event's FAR.
Finally, we remove some fields for unauthenticated users.

No point in allowing access since unauthenticated users don't
see graceids anywhere else and they can't access the events
anyway.

Adding some information for search and latest web views, and
changing what is shown to unauthenticated users.