Test that the add_blurb form renders (#477)

No test requested GET /add_blurb, so a template error or a broken inline script in the form would pass CI. Add a test that signs in through the session, stubs the GitHub App lookups, and checks that the page renders with every field the POST handler reads, the Security option, and the hooks the CVE toggle script relies on. Also test the two redirects around it: an anonymous request to the form goes home, and a signed-in request to the home page goes to the form.

The redirect tests showed that the handlers return HTTPFound instead of raising it, which aiohttp deprecates and which the suite’s warnings-as-errors setting turns into a server error. Raise all six redirects instead, which is also what the error middleware expects.