The features aren't yet filled out, and are represented ❓, but are at
least present and aligned for readability.

Co-authored-by: Michael Muré <batolettre@gmail.com>

This is necessary to get timeline API support.

…menting

This avoids needing real production tokens in order to run the tests,
or needing to reach out to the network.

It also deletes several tests.
- Unnormalized username (non-canonical lowercasing).
  We don't depend on this anywhere in the implementation, we only check
  whether the server says the username is valid or not.
  No point in mocking it.
- Organization username.
  We never call `validateUsername` for a project *owner*, only when
  validating access configuration. Organizations don't have access
  tokens, users do.
- Project validation with different scopes.
  We don't actually care here which scope the token needs -- that's
  something that goes in our docs, not in the code. If the prod API
  returns 404, that's good enough. Note that since Forgejo 15, all
  unauthorized endpoints return 404, not 403, so we don't even need to
  handle this case specially in the implementation.

Using `testing.T` messes up shrinking and filtering.
Add a small helper that allows using either `testing.T` or `rapid.T` so
that we get better coverage and errors.

these were divergences from upstream

This is the only reliable way to get labels, title edits, and open/close
status, so we may as well do it now.