With the addition of guest identities (#6561) eyre started granting
guest identities to unauthenticated requesters. However, requesters that
tried authenticating with _invalid_ credentials (for non-existent or
expired sessions) would be granted a guest identity as well, implicitly
"downgrading" their request in the process, to appear as if originating
from the guest identity.

This behavior is neither correct nor legible. Especially API-level
interactions will want to avoid accidentally opening a channel with an
unexpected identity.

We improve Eyre's behavior by detecting the "invalid session" case and
returning an explicit 401 (unauthorized) response. To make sure that the
browser case doesn't stay stuck in a broken session, we include a
`set-cookie` header that expires the invalid cookie instantly.

In practice, this change _should_ only be user-facing in the "log out of
all sessions" case, where users may see a 401 page in browsers on their
other devices after performing that action. A simple refresh of the page
gets them back into the usual, endpoint-defined behavior.

In practice, header ordering doesn't actually matter. Needing to specify
the headers in the exact order made testing them more difficult than it
should've been.

Here, we alphabetically sort the headers before testing them. ( ex-204-2
is to be removed in a future commit, so is ignored here.)

We do take care to preserve relative ordering between headers that have
the exact same field-name value, because that case _does_ matter.

Cookies have been the bane of eyre tests for a while. We had resorted to
hard-coding the couple of expected cookie values and being careful about
passing them in the right place, right time. This was very finicky.

Here, we update the state that's passed continuously to include a value
for the "live" cookie. The rest of the testing code and helpers are
updated to keep this value updated according to the responses emitted by
eyre, and to inject the cookie into requests we simulate. This way, we
get the desired behavior of remembering the cookie like a browser would.

We get to remove the hard-coded cookie values from most tests. In the
process, we clean up the helpers a little bit, but unfortunately also
have to add more complex helpers for pulling the cookie from state.

All in all, tests should be more robust/flexible, at a small complexity
cost. The pattern here (moving over operations, updating & accumulating
state) might be better implemented as the state machine core (aka abet)
pattern, but that would be a bigger rewrite.

eyre: improve test ergonomics slightly