* implement SASL OAUTHBEARER and draft/bearer
* Upgrade JWT lib
* Fix an edge case in SASL EXTERNAL
* Accept longer SASL responses
* review fix: allow multiple token definitions
* enhance tests
* use SASL utilities from irc-go
* test expired tokens

Add more clarify in NS INFO and SAREGISTER about unregistered nicknames

See #1659

Fixes #1380

Enhancements to NS SUSPEND, including stored metadata and the ability
to list suspensions

Since allocating them is rare.

Or try to, anyway

In the previous commit, the client would receive a failure message but would
actually remain logged in after an authzid/authcid mismatch. This was a
correctness rather than a security issue, but now it's fixed so that the client
never logs in in the first place.

* Fix #684
* Fix #683
* Add `CHANSERV CLEAR`
* Allow mode changes from channel founders even when they aren't joined
* Operators with the chanreg capability are exempt from max-channels-per-account
* Small fixes and cleanup

If you were banned and the ban was only detected when you proxied
(because you were proxying from a DLINE'd IP), you'd get an incorrect
quit message: `QUIT: Bad or unauthorized PROXY command`. This propagates
the correct ban message as the quit line.

Also upgrade RENAME to latest draft specification

Previously, we generated and prepended a long salt before generating
password hashes. This resulted in the hash verification cutting off long
before it should do. This form of salting is also not necessary with
bcrypt as it's provided by the password hashing and verification
functions themselves, so totally rip it out.

This commit also adds the functionality for the server to automagically
upgrade users to use the new hashing system, which means better
security and more assurance that people can't bruteforce passwords.

No need to apply a database upgrade to do this, whoo! \o/