Authorization scopes & popup authorization dialog

[wmurphyrd]

Integration with the new authorizatoin scopes from immers-space/immers#29

• Ensure we fail gracefully when requests are denied
  • Default friends list to empty array to UI doesn't crash if friends list blocked
  • Skip over activitypub avatar creation if not permitted to avoid an unhandle promise exception
  • Most other actions are left alone and will just receive a 403 and handle it
• Update UX to inform users when an action or info isn't available
  • Immers chat posting, friends list, and profile updates show an explanatory message and prompt to re-login
  • Add friend & share selfie buttons are just hidden (couldn't figure a clean way to do the explain&prompt pattern in the 3D assets)
  • Block button label reverts to "Hide"
• Add a configuration option for immers to choose their preferred role to request (will be default selection in dialog)

Update 5/7 - I finished the OAuth popup work and it included a couple bugfixes for the scopes, so I just merged it in to this PR

• Change from redirect-based OAuth to a popup window
• Update react UX to show login prompt and hide immers chat panel before login
• Refactor auth & initialization flow to work with popup
• Change pass-your-handle-through-links to use hash because we no longer update the query during redirect so it would just get stuck in your URL and potentially shared
• Prefill handle in login form when renewing expired token on remote immer