Pass `mypy --strict` without `cast`, `type: ignore`, or features disabled in the configuration file

[exarkun]

This is an umbrella ticket. Specific self-consistent steps towards this goal can be described in new tickets and resolved independent.

ZKAPAuthorizer now has many type annotations. Internally, much of it passes mypy --strict. However, the codebase:

• uses cast in some places to work-around tricky issues
• uses type: ignore in many places, mostly to work around lack of type annotations from dependencies
• turns off some mypy features in setup.cfg to work around other issues, mostly lack of type annotations from dependencies

Each of these work-arounds compromises the value of the static checker to some degree. The fewer work-arounds, the better. When there are zero work-arounds then the static checker should provide a fairly strong guarantee that the codebase actually makes sense at some level (at the type level). This doesn't guarantee the codebase makes sense at the higher level of "satisfies the requirements" but it is a necessary precondition to achieve that.

The reality of static checking in Python might mean that we never get all the way to zero work-arounds but it's a good target to aim at for the time being.