An HttpOnly, SameSite=Lax session cookie is issued when a job is
created. Job and snapshot routes return 404 to any other session, so
indexed source is only readable by the browser that loaded it.
Go's regexp backtracker dominated indexing. Each pattern now runs only
when a cheap necessary-condition check passes, cutting indexing of the
Go standard library source from 4.7s to 1.4s.
Adds BenchmarkIndexDirectory.
Implements the API routes (jobs, progress events, snapshots, search,
entities, source delivery with release) to net/http and serves the
static frontend from the same binary on the same origin.
Andy Dixon