* fix #2129

Don't print the values of environment variable overrides, just the keys

* fix unit tests

* implement SASL OAUTHBEARER and draft/bearer
* Upgrade JWT lib
* Fix an edge case in SASL EXTERNAL
* Accept longer SASL responses
* review fix: allow multiple token definitions
* enhance tests
* use SASL utilities from irc-go
* test expired tokens

Add a configurable limit on realname length

Channels with slashes (or other relaymsg separators) in their names
were being falsely detected as relaymsg identifiers.

See discussion on #2077

https://github.com/ircv3/ircv3-specifications/pull/510

Fixes #1782

Kiwi expects it due to https://github.com/kiwiirc/kiwiirc/pull/1244 , but
the corresponding spec change only altered the cap name, not the 005 name.

Unclear where we got draft/CHATHISTORY from, it looks like the merged drafts
have always used unprefixed CHATHISTORY as the token name.

* optionally protect against multiple starts with flock

Fixes #1823

* use traditional .lock extension

* move config key to top level

Add a config option to suppress LUSERS

Advertising SCRAM-SHA-256 breaks irccloud, which doesn't fall back to PLAIN
if it sees SCRAM advertised but SCRAM then fails (as is the case for any
account password hashed on Ergo 2.7 or lower).

Leave a config option for irctest to enable it in the controller.

This is already implemented, but TARGMAX=KICK:1 says it isn't.

Instead, let's advertise that indefinitely many targets are allowed.
Refs:

* https://defs.ircdocs.horse/defs/isupport.html#targmax
* https://github.com/ircdocs/modern-irc/pull/112

Fixes #1740

Validate operator vhosts against the configured (or default)
vhosts.valid-regexp

Fix a panic if the operator class title is empty

1. Fix auth bypass in the default configuration with the addition of
   server.password (the REGISTER command was allowed before connection
   registration, allowing unauthenticated users to REGISTER and then
   take advantage of skip-server-password)
2. Caution operators against the use of require-sasl without disabling
   user-initiated account registration. (Such a configuration is still valid
   in the case of a public server that requires everyone to register.)

Allow users to set max MySQL connections and connection lifetime;
set a sane default for max connections if it's not present.

Allow setting the minimum TLS version

Implements #1577, but the issue should remain open until we clean up
the debugging loglines.

Improve debuggability of some config deserialization errors

If history is disabled, disable the history CAPs

Fixes #1510

Track channel join times, use them to optionally enforce history access
restrictions

Improve auditability of sensitive operator actions

strip local_ from oper capab names, also consolidate unban into ban

Add the new utf8-only cap, disallow non-utf8 when websockets are enabled

Fixes #810

Tor listeners should never see an STS cap.

Add an undocumented 'hide-sts' key for listeners that hides the STS cap.
This can be used if the listener is secured at layer 3 or 4 (VPNs,
E2E mixnets). It will be necessary to add the relevant IPs to `secure-nets`.

Fixes #1407

Support PROXY protocol v2, including ahead of plaintext connections

See #1171.