upgrade to Rust 1.70, use std::sync::OnceLock

The most notable part of this is that `db::auth` no longer holds a lock
during password hashing operations. That was probably never a great
idea...

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     name: Rust ${{ matrix.rust }}
     strategy:
       matrix:
-        rust: [ "stable", "1.65", "nightly" ]
+        rust: [ "stable", "1.70", "nightly" ]
         include:
           - rust: nightly
             extra_args: "--features nightly --benches"