Adds loginHandler to dbAuth for custom login checks

[cannikin]

This adds two feature requests to dbAuth:

1. Ability to deny login to a user that would otherwise be able to log in (username and password match). A great example of this is a user that hasn't verified their email address yet.
2. Ability to skip auto-login after successful signup. Now you can return a message to the user instead, something like "Verify your email to finish signup".

1. New loginHandler()

By throwing an error with a message in the new loginHandler() option, you can deny them access and show a message:

2. signupHandler() Updates

If you return a user from this function then that user will be signed in.

If you return a string, they will NOT be logged in, and {message: "My text here"} will be returned when you call the signUp() function that you get from useAuth().

If you throw an error, {error: "Error message"} will be returned from signUp().

Breaking Changes

api/src/functions/auth.js

This will require that users who have implemented dbAuth since the last release add a loginHandler() function in their api/src/functions/auth.js setup.

A new instance of DbAuthHandler is created and passed several options. loginHandler() needs to be added to that list:

  const authHandler = new DbAuthHandler(event, context, {
    db: db,
    authModelAccessor: 'user',
    authFields: {
      id: 'id',
      username: 'email',
      hashedPassword: 'hashedPassword',
      salt: 'salt',
    },
    signupHandler: ({ username, hashedPassword, salt, userAttributes }) => {
      return db.user.create({
        data: {
          email: username,
          hashedPassword: hashedPassword,
          salt: salt,
          // name: userAttributes.name
        },
      })
    },
    loginExpires: 60 * 60 * 24 * 365 * 10,

    // ********* ADD THIS FUNCTION ************
    loginHandler: (user) => {
      return user
    },
  })

No changes are necessary to signupHandler() as this is NEW functionality and existing functionality (returning a user or throw an error) is preserved.

Login/Signup Components

The response from signUp() is now an object with an error key if there was an error, or a message key if signupHandler() returns a string. Previously, error messages were returned with a message key only.

If a user is returned and logged in, an object is returned with an id key containing the id of the user.

Docs

Generated functions and components have updated comments explaining what to return in these function in various circumstances. redwoodjs.com doc updates are coming that explain these same changes.

Closes #3064