Reported by @mogad0n; the mute mask was being case-canonicalized,
but the RELAYMSG identifier wasn't being case-canonicalized before
the check.

`WHO #channel o` is supposed to return only server operators.
This is RFC1459 cruft; just return an empty list in this case.

RPL_ENDOFWHO should send the original, un-normalized mask

Improve documentation for use of certificate fingerprints

Reported by @Mikaela; normally this requires +o or higher on the
channel that is the target of the forward, but SAMODE should bypass
this check.

It was sending MESSAGE_ERROR, which was inappropriate. Send an empty batch
for now (this is at parity with the in-memory implementation).

Reported by @mogad0n. If a user had both operator privileges and
channel owner privileges, the CS TRANSFER would proceed as though
unprivileged, requiring acceptance by the receiving user. Fix this
to not require acceptance.

Reported by @tacerus. This was most likely introduced by 8b2f6de3e.

Add a config option to suppress LUSERS

See #1676

Ensure the pagination window is full by making sure that every history item
gets a replay line in CHATHISTORY output, even TAGMSG.

This reverts commit 5bbee02fe6.

Fix various pagination issues with CHATHISTORY; also undo #491
(msgid munging).

Fixes #1787

Partially fixes #1679, not sure whether to police the relaymsg config or not

Warn if the user sent, e.g., /QUOTE /SAMODE instead of /QUOTE SAMODE

RPL_WHOISACTUALLY should display some arbitrarily chosen IP address and
hostname.

* Add email-based password reset

Fixes #734

* rename SETPASS to RESETPASS

* review fixes

* abuse mitigations

* SENDPASS and RESETPASS should both touch the client login throttle
* Produce a logline and a sno on SENDPASS (since it actually sends an email)

* don't re-retrieve the settings value

* add email confirmation for NS SET EMAIL

* smtp: if require-tls is disabled, don't validate server cert

* review fixes

* remove cooldown for NS SET EMAIL

If you accidentally set the wrong address, the cooldown would prevent you
from fixing your mistake. Since we touch the registration throttle anyway,
this shouldn't present more of an abuse concern than registration itself.

Advertising SCRAM-SHA-256 breaks irccloud, which doesn't fall back to PLAIN
if it sees SCRAM advertised but SCRAM then fails (as is the case for any
account password hashed on Ergo 2.7 or lower).

Leave a config option for irctest to enable it in the controller.

Refs:

* other instances in the codebase
* https://defs.ircdocs.horse/defs/numerics.html#err-needmoreparams-461
* https://modern.ircdocs.horse/#errneedmoreparams-461

For consistency with RFC2812, Bahamut, Hybrid, Insp, Plexus4, Unreal.
https://datatracker.ietf.org/doc/html/rfc2812#section-3.2.8

At the expense of consistency with chary/solanum, irc2, and ircu2.

This is already implemented, but TARGMAX=KICK:1 says it isn't.

Instead, let's advertise that indefinitely many targets are allowed.
Refs:

* https://defs.ircdocs.horse/defs/isupport.html#targmax
* https://github.com/ircdocs/modern-irc/pull/112

This should be disallowed; `MODE #keytest +k :` should just be an error.

"LOGOUT ALL" logs out all clients for a user.

Fixes #1712.

reported by @Mikaela

We can check once during initialization of the SASL session, e.g.
on receiving `AUTHENTICATE PLAIN` or `AUTHENTICATE EXTERNAL`

Fixes #1762

See: https://github.com/ircv3/ircv3-specifications/pull/466

A default channel mode of +i would block channel creation; fix this by treating
initial joins as SAJOINs.

Note that it's nontrivial to detect initial join in (*Channel).Join, because
having 0 members does not necessarily indicate a new channel.

Allow SAJOIN or implicit always-on join to override channels.operator-only-creation