Replace AUTH_GUEST_SESSION_JWT_SECRET with a key derived via HMAC-SHA256 from the reva JWT secret. Guest session tokens and reva access tokens remain unforgeable across each other without a second secret to configure.
This starts the guestlinks authprovider as part of the auth-guest service and wires it into the authregistry.