Replace or vendor the `zappa` Git dependency

[rainhead]

zappa is a Git dependency on an abandoned personal fork, and it renders our outbound email templates.

{:zappa, github: "skanderm/zappa", branch: "master"},

State of the upstream repo (skanderm/zappa, a fork of fireproofsocks/zappa):

• Last push 2020-11-03
• 0 stars, 0 open issues
• Not published to Hex

We use it to compile Handlebars templates for email in two places:

• server/lib/orcasite/accounts/email.ex:70
• server/lib/orcasite/notifications/email.ex:204

Why this is worth addressing

1. No advisory coverage. Dependabot, dependency-review-action, and OSV all skip Git dependencies. If a vulnerability were ever reported here, nothing in our tooling would tell us.
2. branch: "master" follows a third-party account. mix.lock pins a SHA today, but any mix deps.update zappa re-resolves against whatever is on that branch at the time. The account is dormant, which makes it exactly the kind of target worth compromising.
3. No upstream to fix anything. A bug in template compilation is ours to fix regardless, so we get none of the usual benefit of an external dependency.

Options

• Vendor it. Zappa is small and we use a single function (Zappa.compile!/1). Copying the relevant modules into server/lib/ under review removes the dependency entirely and puts the code under our own CI and review process. This is probably the least work.
• Pin to a SHA instead of a branch ({:zappa, github: "skanderm/zappa", ref: "d89d983..."}) as a stopgap. Closes the branch-following hole but leaves us with unowned, unmonitored code.
• Replace it with a maintained template engine. More work, and Handlebars-in-Elixir options are thin.

Found while auditing dependency health. Related: #930, #998.