add autogeneration of SCRAM credentials on successful PLAIN

implement SCRAM-SHA-256

We can check once during initialization of the SASL session, e.g.
on receiving `AUTHENTICATE PLAIN` or `AUTHENTICATE EXTERNAL`

replace jwt library

Fixes #1762

See: https://github.com/ircv3/ircv3-specifications/pull/466

fix channel creation bugs

A default channel mode of +i would block channel creation; fix this by treating
initial joins as SAJOINs.

Note that it's nontrivial to detect initial join in (*Channel).Join, because
having 0 members does not necessarily indicate a new channel.

Allow SAJOIN or implicit always-on join to override channels.operator-only-creation

add timeCreated to /uban list output

fix #1751

Add support for KICK #chan user1,user2

RENAME (channel rename) that was a simple case change (e.g.
renaming #chan to #CHAN) would delete the channel :-|

This is one of the two cases of [RFC 2812 kicks](https://datatracker.ietf.org/doc/html/rfc2812#section-3.2.8):
even when there are multiple user targets, the RFC (and Unreal
and Inspircd and probably others) allows a single channel name.

user visible email errors, email timeouts

pin docker base image to alpine 3.13

May fix #1726 (broken build on dockerhub)

fix missing disconnect sno help text

update draft/register -> draft/account-registration

fix #1738

Fixes #1740

See #1659

Fix error message for privileged NS PASSWD on a nonexistent account

add a debug logline for client read errors

May help clarify TLS configuration issues, possibly others too

support systemd notifications

fix UBAN ADD of masks (k-lines) not killing clients

Fixes #1733

DISCONNECT Sno for always-on and/or multiclient

fix #1722

fix #1731

CHATHISTORY INVALID_TARGETS was missing the subcommand parameter

Include nick in ERR_LISTMODEALREADYSET and ERR_LISTMODENOTSET

Validate operator vhosts against the configured (or default)
vhosts.valid-regexp