users.init_app and legacy.init_app were pointing to the same function.

users.create_all and legacy.create_all were pointing to the same
function.

This was just redirection to packages in `arxiv.users`

More clean up of indirection

It was just importing things from `arxiv.users`

Fixes pillow dep issue

Tests under ./arxiv-auth pass

The intent is to better show the relation between the directory and
the package.

Fixes tests in arxiv-auth/arxiv_auth/auth/tests/test_extension.py

And other fixes

Changes to lint.sh and style.sh

Doc style fixes.

Fixes yaml error

Change to deps to try to get github actions to work

This fixes a bug where the query to get a session from the
db was not limiting to the session id from the cookie.

Setting either `Flask.config['ARXIV_AUTH_DEBUG']` or env var
ARXIV_AUTH_DEBUG will turn on logging debugging messages for several
auth packages.

It is no longer needed and and causes unnecessary configuration complexity and
problems.

The AUTH_UPDATED_SESSION_REF was only in place to ease the transition from
placing the auth object on `request.session` to `request.auth`. Placing in at
`request.session` was a mistake during the NG because it interfered with flask
sessions.

Also bumps version from 1.0 to 1.1.

Used by vault but we don't use vault anymore.

Just reorganizing config.py to make it more clear.

To reduce the chance of problems in the case of a misconfigure

Still need to add the required config for auth.

The call to legacy init_app is also made in arxiv_auth.auth.Auth()
so it is redundant.

Merges to python 3.10 code