Improve our approach for testing auth

Our auth tests tend to fall into one of two categories

Either we implement auth on a base class, then test the auth is handed correctly in the base class using a dummy
https://github.com/badges/shields/blob/master/services/stackexchange/stackexchange-base.spec.js

Or we pick one concrete implementation and test that
https://github.com/badges/shields/blob/master/services/gitlab/gitlab-tag.spec.js

This is not water-tight.

As @calebcartwright suggests in https://github.com/badges/shields/pull/9387#discussion_r1299106960
it would be good if we could be a bit more robust about this and make sure we cover all the concrete service classes that are supposed to use auth.

I've not tried it yet, but one possible solution might be to encapsulate the test boilerplate once in a function, then loop over all the relevant classes and call it

something like

```js
function runTheTests(ServiceClass) {
const service = new ServiceClass();
// setup
// make assertions
}

for (const serviceClass of [ServiceClass1, ServiceClass2]) {
runTheTests(serviceClass)
}
```