fix #2149 (backport to stable)

* Add caddy reverse proxy websocket example

* Use consistent hostname for caddy reverse proxy

* Explain reverse proxy setup for websockets

* Update MANUAL.md

Clarify that we only support `X-Forwarded-For`

---------

Co-authored-by: Shivaram Lingamneni <slingamn@cs.stanford.edu>

bump version and changelog for 2.13.0-rc1

add panic handler to async client/channel writes

See #2113 for motivation

fix #2114

Channels with slashes (or other relaymsg separators) in their names
were being falsely detected as relaymsg identifiers.

fix #2113

Persisting always-on clients was panicking if client X believed it was
a member of channel Y, but channel Y didn't have a record of client X.

Remove numerics associated with the retired ACC spec

fix #2108

Bump golang.org/x/crypto from 0.5.0 to 0.17.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.5.0 to 0.17.0.
- [Commits](https://github.com/golang/crypto/compare/v0.5.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

include a fixed test vector in password tests

Send Message-ID even if DKIM is not enabled, for compatibility with Gmail:

* A workaround for Ergo 2.12.0 is to enable DKIM
* You need to enable either DKIM or SPF (preferably both) to send to Gmail anyway
* You also need forward-confirmed reverse DNS, which can be tricky for IPv6...

* bump docker base image to alpine 3.19

Fixes #2103

add `init: true` to docker-compose.yml

Follows up from #2096, #2097

* add --init to suggested docker run invocations

See #2096; this should fix unreaped zombies when using an auth-script or
ip-check-script that spawns its own subprocesses, then exits before reaping
them.

* add a note on why --init

bump irctest

Fix typo in ACCOUNT_NAME_MUST_BE_NICK code

* changelog for v2.12.0-rc1

* bump date

upgrade go-ident

Fixes a socket leak (that doesn't seem to be affecting tilde.town?)

* Fix #1997 (allow the use of an external file for the email blacklist)
* Change config key names for blacklist (compatibility break)
* Accept globs rather than regexes for blacklist by default
* Blacklist comparison is now case-insensitive