Add idempotency middleware

[nanuuki]

This adds basic idempotency middleware for POST endpoints:

• only the idempotency key is stored, so the payload is not examined when checking the received idempotency key and hence only 409 can be returned (key already used). A 422 response would require storing the payload.
• there are 3 supported "databases" (see README for configuration):
  • local: in-memory, single instance only, mainly for testing purposes
  • shared: use the same db as main app
  • redis: use a separate Redis instance
• keys expire after 1 hour, meaning the same key can be used after >1 hour after previous usage
• key is expected to be sent in the Idempotency-Key header (OpenAPI spec has been updated accordingly)

Resolves #185

[latenssi]

Looking good, nice job!

Only thing requesting for attention is the panics in the http handler. I think we should avoid panicing once the service is running but if you think it is necessary in that particular circumstance then I am ok with it.