create: keep ids server-owned

[aberoham]

NicTool/validate#34 forbids id on create. Every HTTP POST now leaves identifier allocation to the store. mysql uses its auto-increment columns. The json and toml stores serialize create allocation per file in the API process. A high-water id prevents reuse after the highest row is deleted. Allocation fails when the backend id type is exhausted.

The branch is rebased over #69 and #71. Internal creates with explicit ids keep #69's collision rejection. HTTP creates carrying an id are refused for group, nameserver, permission, and user. Zone and zone record creates refuse it too. Creates without an id still allocate one. PUT keeps using the id in the route.

The file-store regression runs twenty concurrent group creates on both json and toml. Each gets ids 1 through 20. After id 20 is destroyed, the next create gets 21.

mysql  418 tests, 418 pass, 0 failed, 0 skipped
json   396 tests, 396 pass, 0 failed, 0 skipped
toml   396 tests, 396 pass, 0 failed, 0 skipped

validate#34 is merged but not released. CI installs its merge commit, 4503776, from source. After the release, that temporary source pin can be dropped and the declared dependency bumped. The shared coverage workflow cannot take the source pin, so coverage remains red until then.

This completes the final unfinished API #6 item about caller-controlled auto-increment fields. Its permissions checkbox is still unticked, but #57 already implemented it.

[msimerson]

I'm confined to a phone screen today, but if you checkout the subproject '.release" in the validate repo, and follow the README steps, it'll create a release PR which I can merge and will auto-release.