feat(client): add Go client for notices

[benhoyt]

This adds the Go client for Pebble Notices (see spec JU048).

Here is a summary of the new Client methods:

Notify(opts *NotifyOptions) (string, error)
Notice(id string) (*Notice, error)
Notices(opts *NoticesOptions) ([]*Notice, error)
WaitNotices(ctx context.Context, serverTimeout time.Duration, opts *NoticesOptions) ([]*Notice, error)

[flotter]

Looks great. A couple of questions for the purpose of learning from this :)

[niemeyer]

Thanks for the PR. Looks good, with just high-level tuning.

[niemeyer]

Commenting here to avoid mixing with the unrelated thread below.

Taking a raw string from the outside world and blindly appending it to the GET path with zero validation is anxiety inducing. This is the kind of thing that can be exploited in an application we have no visibility over and become an actual hack.

[benhoyt]

I can see what you're saying, but I'm not so sure. Go will safely and properly percent-escape any disallowed characters, and the server will unescape (and will not find the notice).

However, I've added a simple client-side validation -- that's slightly more permissive than the integers we produce now for future-proofing -- see what you think.

If you think this is a good approach, I can create a PR to do something similar in client/changes.go, where we do the same thing.

[benhoyt]

I've opened #318 to track that.