Also add +C no-ctcp mode, since it's not conflicted

The isupport is always a pure function of the Config object,
not of Server or any globals.

In the k8s PROXY-before-TLS setting, we don't know all the IPs
of the load balancers, so we can't whitelist them, so they're at
risk of being d-lined.

This reverts commit a120cc2443.

In the previous commit, the client would receive a failure message but would
actually remain logged in after an authzid/authcid mismatch. This was a
correctness rather than a security issue, but now it's fixed so that the client
never logs in in the first place.

History couldn't be enabled by rehash if autoresize-window was nonzero.

1. If both fingerprint and hash are specified, require both instead of either
2. Implement auto-oper on connect

In particular, allow hostnames without periods (like on a LAN).
This shouldn't be a client compability concern since we allow
vhosts without periods.