Reject bare * and unknown remotes on evict, serialise with fetch lock

- return 400 for a bare * and 404 for an unknown remote
- take the per-path fetch lock for single-path evicts
- pass the evictor to Routes so local routes no longer carry it
- test If-None-Match revalidation, ForgetPath/ForgetPrefix glob escaping

internal/api/v2/local_objects_test.go

@@ -40,7 +40,7 @@ func TestLocalObjectsListing(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	h := NewObjectsHandler(db, nil)
+	h := NewObjectsHandler(db)
 	router := chi.NewRouter()
 	router.Route("/locals/{name}/objects", func(r chi.Router) {
 		r.Get("/", h.LocalRoutes().ServeHTTP)