Scope jobs and snapshots to a browser session

An HttpOnly, SameSite=Lax session cookie is issued when a job is
created. Job and snapshot routes return 404 to any other session, so
indexed source is only readable by the browser that loaded it.

indexer.go

@@ -46,6 +46,7 @@ type Edge struct {
 
 type Snapshot struct {
 	ID, Name, Source string
+	Owner            string // session that created the snapshot
 	Files            []FileRecord
 	Edges            []Edge
 	TotalLines       int