(Haven't decided what to do at the spec level yet)

We were checking the login throttle at the beginning of every SASL
conversation. This had several problems:

1. Pidgin (on Windows?) tries every mechanism in order, regardless of
the CAP advertisement. It would use up the default throttle allowance
trying unsupported mechanisms like CRAM-MD5.
2. The throttle was actually checked twice for AUTHENTICATE PLAIN
(once at the start of the conversation and once in AuthenticateByPassphrase).

The general pattern here is that we should check the throttle every time we
do something "expensive" (bcrypt verification, send a reset email) or
"dangerous" (anything that could lead to a bruteforce attack on passwords).
Therefore, delete the check from the AUTHENTICATE handler, and add one at
the beginning of the SCRAM conversation to replace it.

See #1686; this allows i2pd to pass the i2p address to Ergo, which may be
useful for moderation under some circumstances.

* implement SASL OAUTHBEARER and draft/bearer
* Upgrade JWT lib
* Fix an edge case in SASL EXTERNAL
* Accept longer SASL responses
* review fix: allow multiple token definitions
* enhance tests
* use SASL utilities from irc-go
* test expired tokens

Add a configurable limit on realname length

Remove numerics associated with the retired ACC spec

* Makefile: Add dependencies between targets

* Implement draft/message-redaction for channels

Permission to use REDACT mirrors permission for 'HistServ DELETE'

* Error when the given targetmsg does not exist

* gofmt

* Add CanDelete enum type

* gofmt

* Add support for PMs

* Fix documentation of allow-individual-delete.

* Remove 'TODO: add configurable fallback'

slingamn says it's probably not desirable, and I'm on the fence.
Out of laziness, let's omit it for now, as it's not a regression
compared to '/msg HistServ DELETE'.

* Revert "Makefile: Add dependencies between targets"

This reverts commit 2182b1da69.

---------

Co-authored-by: Val Lorentz <progval+git+ergo@progval.net>

CHATHISTORY TARGETS response should not be in a batch unless the client has
explicitly requested the batch cap.

* tweaks to NAMES implementation

* tweak member caching

* add a benchmark for NAMES

Remove `<no reason supplied>`, make default KILL anonymous

* implement draft/pre-away
* clean up some subtleties in auto-away aggregation.
* consistently apply auto-away only to always-on
* `AWAY *` should not produce user-visible changes wherever possible

Sanitize the in-band error message from REHASH

TAGMSG should not get automatic RPL_AWAY replies

Add WHO responses for services

According to the de facto standard, `AWAY :\r\n` is equivalent to `AWAY\r\n`.
Our behavior was inconsistent before, now it consistently matches the de facto
standard.

WHO <nickname> should not respect +i

Sanitize ::1 to 0::1 in WHOX output

* Add ACCEPT-tracking functionality (authorizing users to send DMs
  despite +R or other applicable restrictions)
* Sending a DM automatically accepts the recipient
* Add explicit ACCEPT command

Add more clarify in NS INFO and SAREGISTER about unregistered nicknames

Fixes #1924

`NICK :` pre-registration needs to be special-cased to immediately
send ERR_NONICKNAMEGIVEN (unlike erroneous nonempty nicknames,
which are processed when registration is complete)

LIST should not return ERR_NOSUCHCHANNEL for nonexistent channels

* Fix #1911 +s channels don't appear in /list even though on the channel

* use channel.HasClient instead of custom iterative checker

Include server start time in INFO output.

Having the 'samode' capability made all KICK commands privileged. This appears
to have been introduced unintentionally by 42316bc04f and I can't find
any discussion of a rationale. Since this goes against our policy that all
ircop (as opposed to channel founder) privileges must be invoked explicitly
(e.g. SAJOIN, SAMODE), remove this.

This extends #1650 to cover WHO as well as WHOIS

The arithmetic was assuming that the nickname is * (which it is
pre-registration). However, we were sending the actual nickname
post-registration. It would be simpler to always send *, but it
appears that the nickname is actually required by the spec:

>Replies from the server must [sic] contain the client identifier name or
>asterisk if one is not yet available.

Jobe points out that 0 is a valid oplevel in some contexts,
* is a better placeholder for "unimplemented".

See discussion on #1852

From discussion with @emersion, this will help with UX if people try to
log into their unverified accounts.

Account registrations pending verification should produce a logline and
send a sno.