feat: add ability to listen on unix socket/named pipe

Add a -socket option that configures the server to listen on a Unix-domain socket or Windows named pipe instead of a TCP port.  This allows webhook to be used behind a reverse proxy on multi-tenant shared hosting without the need to choose (and the permission to bind to) a free port number.

On Windows, -socket is expected to be a named pipe such as \\.\pipe\webhook, and the code uses https://github.com/microsoft/go-winio to bind the listening socket.  On other platforms, -socket is the path to a Unix domain socket such as /tmp/webhook.sock, or an abstract socket name starting with @, bound using the regular net.Listen function with the "network" parameter set to "unix".

Note: this pushes our minimum Go version up to 1.21 as that is what go-winio requires, but that is already the minimum version against which we are testing in the CI matrix.

.github/workflows/build.yml

@@ -2,6 +2,13 @@ name: build
 on: [push, pull_request]
 jobs:
   build:
+    env:
+      # The special value "local" tells Go to use the bundled Go
+      # version rather than trying to fetch one according to a
+      # `toolchain` value in `go.mod`. This ensures that we're
+      # really running the Go version in the CI matrix rather than
+      # one that the Go command has upgraded to automatically.
+      GOTOOLCHAIN: local
     strategy:
       matrix:
         go-version: [1.21.x, 1.22.x]