Reject unknown Slack tokens in strict mode

• Return invalid_auth in strict mode for Web API tokens that do not come from seed config, server options, or an OAuth exchange, including HTTP Basic credentials outside oauth.v2.access, instead of the default fallback user.
• Keep the fallback in the default mode, with regression coverage and docs.

References:

• invalid_auth, "Method was called with invalid credentials": https://docs.slack.dev/reference/methods/auth.test

Fixes #357