Make (*Client).Sessions() lock-free

From discussion with @emersion, this will help with UX if people try to
log into their unverified accounts.

Warn about banning a single IPv6 address

Account registrations pending verification should produce a logline and
send a sno.

CS PURGE should send a snomask

Send snomasks for HS SET

Reported by @mogad0n; the mute mask was being case-canonicalized,
but the RELAYMSG identifier wasn't being case-canonicalized before
the check.

`WHO #channel o` is supposed to return only server operators.
This is RFC1459 cruft; just return an empty list in this case.

RPL_ENDOFWHO should send the original, un-normalized mask

Improve documentation for use of certificate fingerprints

Reported by @Mikaela; normally this requires +o or higher on the
channel that is the target of the forward, but SAMODE should bypass
this check.

It was sending MESSAGE_ERROR, which was inappropriate. Send an empty batch
for now (this is at parity with the in-memory implementation).

Reported by @mogad0n. If a user had both operator privileges and
channel owner privileges, the CS TRANSFER would proceed as though
unprivileged, requiring acceptance by the receiving user. Fix this
to not require acceptance.

Reported by @tacerus. This was most likely introduced by 8b2f6de3e.

Add a config option to suppress LUSERS

See #1676

Ensure the pagination window is full by making sure that every history item
gets a replay line in CHATHISTORY output, even TAGMSG.

This reverts commit 5bbee02fe6.

Fix various pagination issues with CHATHISTORY; also undo #491
(msgid munging).

Fixes #1787

Partially fixes #1679, not sure whether to police the relaymsg config or not

Warn if the user sent, e.g., /QUOTE /SAMODE instead of /QUOTE SAMODE

RPL_WHOISACTUALLY should display some arbitrarily chosen IP address and
hostname.

* Add email-based password reset

Fixes #734

* rename SETPASS to RESETPASS

* review fixes

* abuse mitigations

* SENDPASS and RESETPASS should both touch the client login throttle
* Produce a logline and a sno on SENDPASS (since it actually sends an email)

* don't re-retrieve the settings value

* add email confirmation for NS SET EMAIL

* smtp: if require-tls is disabled, don't validate server cert

* review fixes

* remove cooldown for NS SET EMAIL

If you accidentally set the wrong address, the cooldown would prevent you
from fixing your mistake. Since we touch the registration throttle anyway,
this shouldn't present more of an abuse concern than registration itself.

Advertising SCRAM-SHA-256 breaks irccloud, which doesn't fall back to PLAIN
if it sees SCRAM advertised but SCRAM then fails (as is the case for any
account password hashed on Ergo 2.7 or lower).

Leave a config option for irctest to enable it in the controller.

Refs:

* other instances in the codebase
* https://defs.ircdocs.horse/defs/numerics.html#err-needmoreparams-461
* https://modern.ircdocs.horse/#errneedmoreparams-461

For consistency with RFC2812, Bahamut, Hybrid, Insp, Plexus4, Unreal.
https://datatracker.ietf.org/doc/html/rfc2812#section-3.2.8

At the expense of consistency with chary/solanum, irc2, and ircu2.

This is already implemented, but TARGMAX=KICK:1 says it isn't.

Instead, let's advertise that indefinitely many targets are allowed.
Refs:

* https://defs.ircdocs.horse/defs/isupport.html#targmax
* https://github.com/ircdocs/modern-irc/pull/112

This should be disallowed; `MODE #keytest +k :` should just be an error.

"LOGOUT ALL" logs out all clients for a user.

Fixes #1712.

reported by @Mikaela