Implement player certificate fetching for Mojang auth

[evan-goode]

"Mojang auth" (now ironically named) is still in use today by custom authentication servers. We are grateful for node-minecraft-protocol's continued support for it! Some of these custom authentication servers [0][1] support player certificates just like Mojang's API servers do, at the $servicesServer/player/certificates endpoint (when using Mojang's servers, $servicesServer = https://api.minecraftservices.com). The process for fetching player certificates is no different when using a Microsoft account or a Mojang/other account. It works like any other Mojang API route that requires an accessToken. But in node-minecraft-protocol, Microsoft authentication, including certificate fetching, is done in prismarine-auth and certificate fetching isn't implemented for third-party accounts.

This PR copies the certificate fetching logic from prismarine-auth to mojangAuth.js in node-minecraft-protocol to make certificate fetching work with third-party accounts. Certificate fetching can be disabled by setting disableChatSigning: true just like with Microsoft accounts. If certificates fetching fails, a warning is printed and login continues.

An alternative approach to copying would be to export fetchCertificates from prismarine-auth and somehow make it possible to override the servicesServer there. But IMHO the cleaner option is to duplicate the code in node-minecraft-protocol, it's only ~20 lines.

[0] https://github.com/unmojang/drasl
[1] https://ely.by/

[evan-goode]

Thanks for the approval. The CI failure seems to be transient and unrelated.

[rom1504]

cb can't be async

[evan-goode]

Hmm... why not? Everywhere cb is called, the return value is not used, so does it matter whether it returns a Promise or undefined? And cb is already used as a callback at

                yggdrasilClient.auth({
                  user: options.username,
                  pass: options.password,
                  token: clientToken,
                  requestUser: true
                }, cb)

so we do not need to guarantee that auth is complete by the time the outer exported auth function returns, that's what the session event is for.

[rom1504]

"cb is used as a callback" is exactly the issue

Callback and promise/async are 2 mutually exclusive options

If you put async keyword on a function, it means some code will await that function wereas a callback is called directly without await

[evan-goode]

Sometimes it's nice to use async just so you can use await within the function itself, without necessarily using the returned Promise. But I can rewrite this with additional callbacks if you'd like. I think functionally it'd be the same.