Slack: strict mode accepts tokens the emulator never issued

Problem

Slack answers invalid_auth to a Web API call made with a token it never issued. With slack.strict_scopes: true, the emulator still authenticates such a token as the default fallback user, so tests asserting that a made-up or leaked token fails pass without that behavior being represented. Revocation by apps.uninstall already works, because revoked tokens are checked before the fallback.

Proposal

• In strict mode, return invalid_auth for a Web API token that does not come from seed config, server options, or an OAuth exchange.
• Keep the fallback user in the default mode, as the Google strict mode does since #218.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/slack-strict-unknown-tokens. Happy to open a pull request for it.