Use new version of Web Push API (that accepts payload)

• Update the web-push project to the new specification.
• Update the queue project to use the new web-push project. The Subscription now needs an auth field in addition to the key field (this is used by Chrome).

This update allows simplifying the code, as we can send the data along with the push notification (instead of fetching it from the server). We no longer need to mark notifications as delivered to keep track of which notifications have (not) been delivered. Also eliminates a CSRF vulnerability, as the service worker had no access to the CSRF token.