Remove werkzeug as a dependency

[bloodearnest]

We used werkzeug for WSGI responses and for local thread/greenlet context, but it would be good to remove it. This would mean some simple WSGI boilerplate for endpoints, but also need a replacement for the local context.

The obvious choice for this is the new stdlib contextvars, (with pre 3.7 backport), so we should see if that would enable dropping werkzeug

[bloodearnest]

I had a look at this, and while we don't use werkzeug.local any more, we do still use it for a bunch of wsgi/http stuff that's non-trivial, like content negotiation, so we'd need to implement that ourselves if we want to remove it