auth: don't use json for debug logging

The json formatting is just a source of error - it will for example crash if
there should be bytes anywhere.

auth: move 'active' handling out of the individual auth modules

The 'active' flag in the Kallithea user database is very fundamental and should
not be specific to auth modules. Modules should only care about whether the
user is active in the external authentication system.

user_activation_state is thus removed, and 'hg.extern_activate.auto' is now
consistently checked for all kinds of external authentication.

auth: drop active_from_extern from internal auth API

Modules should never auth a user if the auth source knows the user is inactive.
Also, it is too late and unreliable to disable users when they try to log in.
There is thus no need for this concept.

Only the crowd module had some traces of actual active_from_extern usage. The
'active' flag for crowd users was fully controlled from crowd. Now, Instead,
just let crowd reject authentication of users that are inactive in crowd, and
leave the internal Kallithea 'active' flag under admin control.

cleanup: refer less to User.DEFAULT_USER

Down the road we might want to identify the default user in another
way than by username.

auth: remove KallitheaCrypto pseudo-class

Every caller except one already used the module-level wrapper functions.

auth: cleanup of EXTERN_TYPE_INTERNAL

Don't set it in top level namespace - it is a weak link between the database
and the actual implementation. Don't make it more than that.

Don't hardcode in that many places that 'internal' is the default - just call
it DEFAULT_AUTH_TYPE.

Don't use it for extern_name - it is only intended for use as extern_type.

Remove unused uses.

auth: fail pam and internal authentication attempts if no username is provided (Issue #180)

When the Mercurial client communicates with a server over HTTP, it will always
first try to perform operations unauthenticated before providing credentials.
Authentication attempts without credentials is usually pointless and will just
slow operations down.

Some authentication plugins (such as LDAP) already skipped these
unauthenticated requests. Now, do the same for other authentication plugions.

Other authentication plugins also skip if no password is provided ... but that
doesn't seem necessary.

cleanup: make module self-naming consistent

The self naming is quite pointless ... but at least make it right.