create: keep ids server-owned

[aberoham]

With id forbidden on create (NicTool/validate#34), the file stores have to allocate their own. nextId() moves into lib/store/file.js. That also retires the two hand-rolled copies of the same reduce in the session and zone record stores. The mysql user store no longer looks up {id: undefined, gid} before every insert.

Route coverage per entity. A create carrying an id is refused. A create without one allocates and returns it. A PUT with a route id still works.

mysql  406 tests, 406 pass, 0 failed, 0 skipped
json   383 tests, 383 pass, 0 failed, 0 skipped
toml   383 tests, 383 pass, 0 failed, 0 skipped

Draft until validate#34 merges. CI installs that PR's head from source, per the pattern in 7a64bad. When it merges, NICTOOL_VALIDATE_SPEC moves to the merge commit. When it releases, the variable goes and the dependency bumps.

coverage.yml runs the shared NicTool/.github job and cannot take that variable, so coverage is red on the new tests until the release.

Ticks "verify the API won't permit setting auto-increment fields" in #6. The
other two boxes there are untouched.

[msimerson]

I'm confined to a phone screen today, but if you checkout the subproject '.release" in the validate repo, and follow the README steps, it'll create a release PR which I can merge and will auto-release.