* changelog for v2.14.0-rc1

* bump version string for rc1

* bump irctest

Increase default/recommended mask list size limit to 150;
SAMODE overrides enforcement of the limit.

Don't send RPL_CHANNELMODEIS for no-op changes to channel-user modes

Add human-readable description parameters to multiline fail messages,
since they are technically required by the standard-replies spec
(although the utility of showing them to users is dubious)

Log errors from attempting to delete a unix domain socket path

(Haven't decided what to do at the spec level yet)

Add optional support for rfc1459 and rfc1459-strict casemappings

We were checking the login throttle at the beginning of every SASL
conversation. This had several problems:

1. Pidgin (on Windows?) tries every mechanism in order, regardless of
the CAP advertisement. It would use up the default throttle allowance
trying unsupported mechanisms like CRAM-MD5.
2. The throttle was actually checked twice for AUTHENTICATE PLAIN
(once at the start of the conversation and once in AuthenticateByPassphrase).

The general pattern here is that we should check the throttle every time we
do something "expensive" (bcrypt verification, send a reset email) or
"dangerous" (anything that could lead to a bruteforce attack on passwords).
Therefore, delete the check from the AUTHENTICATE handler, and add one at
the beginning of the SCRAM conversation to replace it.

RPL_NAMREPLY should send = for normal channels and @ for secret channels,
as per Modern docs.

See #1686; this allows i2pd to pass the i2p address to Ergo, which may be
useful for moderation under some circumstances.

Allow specifying TCP4 or TCP6 for outgoing email sending, or choosing a
specific local address to send from.

Database backup filenames contained a colon character, which is disallowed
on Windows; use period instead

* fix #2133

Don't record NICK and QUIT in history for invisible auditorium members

Handling of reserved nicknames is special-cased due to #1594, but we want to send
ERR_NICKNAMEINUSE if the nickname is actually in use, since that doesn't pose any
client compatibility problems.

* fix #2129

Don't print the values of environment variable overrides, just the keys

* fix unit tests

We load registered channels unconditionally; reloading them again on rehash
is incorrect. This caused buggy behavior when channel registration was
disabled in the config, but some registered channels were already loaded.

* Gracefully handle NS cert add myself <fp>

A non-operator with the nick "mynick" attempts to register
a fingerprint to their authenticated account.

They /msg NickServ cert add mynick <fingerprint>

NickServ responds with "Insufficient privileges" because
they've accidentally invoked the operator syntax (to action
other accounts).

This patch allows the user to add the fingerprint if the client's
account is identical to the target account.

Signed-off-by: Matt Hamilton <m@tthamilton.com>

* Update nickserv.go

Compare the case-normalized target to Account()

---------

Signed-off-by: Matt Hamilton <m@tthamilton.com>
Co-authored-by: Shivaram Lingamneni <slingamn@cs.stanford.edu>

* implement SASL OAUTHBEARER and draft/bearer
* Upgrade JWT lib
* Fix an edge case in SASL EXTERNAL
* Accept longer SASL responses
* review fix: allow multiple token definitions
* enhance tests
* use SASL utilities from irc-go
* test expired tokens

Add a configurable limit on realname length

See #2113 for motivation

Channels with slashes (or other relaymsg separators) in their names
were being falsely detected as relaymsg identifiers.

Persisting always-on clients was panicking if client X believed it was
a member of channel Y, but channel Y didn't have a record of client X.

Remove numerics associated with the retired ACC spec

Send Message-ID even if DKIM is not enabled, for compatibility with Gmail:

* A workaround for Ergo 2.12.0 is to enable DKIM
* You need to enable either DKIM or SPF (preferably both) to send to Gmail anyway
* You also need forward-confirmed reverse DNS, which can be tricky for IPv6...

* Fix #1997 (allow the use of an external file for the email blacklist)
* Change config key names for blacklist (compatibility break)
* Accept globs rather than regexes for blacklist by default
* Blacklist comparison is now case-insensitive

See discussion on #2077

See #2013; given that plaintext is deprecated now, it seems like there is no
added value from continuing to police this.

This was introduced in 38a6d17ee5

* don't send multiline responses to CAP LS 301

This is more or less explicitly prohibited by the spec:

https://ircv3.net/specs/extensions/capability-negotiation.html#multiline-replies-to-cap-ls-and-cap-list

* switch to whitelist model to be future-proof

* bump irctest to include test

* add a unit test