golang's crypto module (used by gogs with its default MACs) defines hmac-sha1-96 that is considered weak by security scanning tools such as Tenable (https://www.tenable.com/plugins/nessus/71049), so we need a way to select with algorithms to use.
I already have this code in my fork.