ZKAPAuthorizer

These are mostly modelled on upstream nixos modules. They are generally fairly configurable (they don't tend to hard-code paths, they can be enabled or disabled). They don't know anything about morph (e.g. deployment.secrets) or how the different grids are configured (e.g. grid.publicKeyPath). Each module here tends to define one service (or group of related services) or feature. Eventually, all of these will be imported automatically and controlled by services.private-storage.*.enabled options.