* implement SASL OAUTHBEARER and draft/bearer
* Upgrade JWT lib
* Fix an edge case in SASL EXTERNAL
* Accept longer SASL responses
* review fix: allow multiple token definitions
* enhance tests
* use SASL utilities from irc-go
* test expired tokens

Fixes a socket leak (that doesn't seem to be affecting tilde.town?)

* optionally protect against multiple starts with flock

Fixes #1823

* use traditional .lock extension

* move config key to top level

These should have been committed in 8218d1caab
but weren't.

Resolves CVE-2021-42836, which probably didn't affect us, but we might as well
upgrade.

Fixes #1762

Fixes #1733

Potentially fixes the database corruption seen on #1603

Implements #1577, but the issue should remain open until we clean up
the debugging loglines.

Validate tag names and values in accordance with the ratified message-tags spec