hg: support protocol commands used by hg-evolve

When cloning or pulling from a repository which uses the evolve extension
Kallithea would require write permissions for multiple commands:
evoext_obshashrange_v1, _exttopics_heads and tns_heads.

https://foss.heptapod.net/mercurial/evolve/-/blob/6ffc4d7635fac0e605eb44b77de539f64c3739a2/hgext3rd/topic/server.py#L134
https://foss.heptapod.net/mercurial/evolve/-/blob/6ffc4d7635fac0e605eb44b77de539f64c3739a2/hgext3rd/evolve/obsdiscovery.py#L722

Fixed by adding them to the list of known read-only commands.

hg: support new clonebundles_manifest write protocol command

A new wire protocol command was introduced with Mercurial 6.5 -
https://repo.mercurial-scm.org/hg/rev/4238e6b22fc4 .

When a client (after negotiation with the server) decided to use this new
command, Kallithea would fail safely and require write permissions.

Fixed by adding it to the list of known read-only commands.

controllers: move controllers base class from lib/base to controllers

TG quickstart put it in lib/base.py , but it fits better on the controllers
layer as a base there.

The contributing docs were a bit ahead of time ... but with a typo.

config: move WSGI middleware apps from lib to config

These middlewares are full WSGI applications - that is not so lib-ish. The
middleware is referenced from the application in config - that seems like a
good place for them to live.