Read the expiry form value where the body is bounded (#43)

The pinned CI linter's gosec G120 flagged r.FormValue in
buildDatabaseTargetConfig because the MaxBytesReader guard lives
one function up in processTargetCreate, out of static-analysis
sight. Read the expiry alongside the other form values in
processTargetCreate and pass it down as a string, matching how
the http and slack config builders receive their URL.

internal/handlers/export_test.go

@@ -28,7 +28,7 @@ func (s *Handlers) BuildSlackTargetConfigForTest(
 // package.
 func (s *Handlers) BuildDatabaseTargetConfigForTest(
 	w http.ResponseWriter,
-	r *http.Request,
+	expiry string,
 ) (string, error) {
-	return s.buildDatabaseTargetConfig(w, r)
+	return s.buildDatabaseTargetConfig(w, expiry)
 }