implement tls client certificate authentication

the imap & smtp servers now allow logging in with tls client authentication and
the "external" sasl authentication mechanism. email clients like thunderbird,
fairemail, k9, macos mail implement it. this seems to be the most secure among
the authentication mechanism commonly implemented by clients. a useful property
is that an account can have a separate tls public key for each device/email
client.  with tls client cert auth, authentication is also bound to the tls
connection. a mitm cannot pass the credentials on to another tls connection,
similar to scram-*-plus. though part of scram-*-plus is that clients verify
that the server knows the client credentials.

for tls client auth with imap, we send a "preauth" untagged message by default.
that puts the connection in authenticated state. given the imap connection
state machine, further authentication commands are not allowed. some clients
don't recognize the preauth message, and try to authenticate anyway, which
fails. a tls public key has a config option to disable preauth, keeping new
connections in unauthenticated state, to work with such email clients.

for smtp (submission), we don't require an explicit auth command.

both for imap and smtp, we allow a client to authenticate with another
mechanism than "external". in that case, credentials are verified, and have to
be for the same account as the tls client auth, but the adress can be another
one than the login address configured with the tls public key.

only the public key is used to identify the account that is authenticating. we
ignore the rest of the certificate. expiration dates, names, constraints, etc
are not verified. no certificate authorities are involved.

users can upload their own (minimal) certificate. the account web interface
shows openssl commands you can run to generate a private key, minimal cert, and
a p12 file (the format that email clients seem to like...) containing both
private key and certificate.

the imapclient & smtpclient packages can now also use tls client auth. and so
does "mox sendmail", either with a pem file with private key and certificate,
or with just an ed25519 private key.

there are new subcommands "mox config tlspubkey ..." for
adding/removing/listing tls public keys from the cli, by the admin.

imapserver/server_test.go

@@ -162,6 +162,7 @@ type testconn struct {
 	done       chan struct{}
 	serverConn net.Conn
 	account    *store.Account
+	switchStop func()
 
 	// Result of last command.
 	lastUntagged []imapclient.Untagged
@@ -315,6 +316,9 @@ func (tc *testconn) close() {
 	tc.client.Close()
 	tc.serverConn.Close()
 	tc.waitDone()
+	if tc.switchStop != nil {
+		tc.switchStop()
+	}
 }
 
 func xparseNumSet(s string) imapclient.NumSet {
@@ -338,15 +342,23 @@ func startNoSwitchboard(t *testing.T) *testconn {
 const password0 = "te\u0301st \u00a0\u2002\u200a" // NFD and various unicode spaces.
 const password1 = "tést    "                      // PRECIS normalized, with NFC.
 
-func startArgs(t *testing.T, first, isTLS, allowLoginWithoutTLS, setPassword bool, accname string) *testconn {
+func startArgs(t *testing.T, first, immediateTLS bool, allowLoginWithoutTLS, setPassword bool, accname string) *testconn {
+	return startArgsMore(t, first, immediateTLS, nil, nil, allowLoginWithoutTLS, false, setPassword, accname, nil)
+}
+
+// todo: the parameters and usage are too much now. change to scheme similar to smtpserver, with params in a struct, and a separate method for init and making a connection.
+func startArgsMore(t *testing.T, first, immediateTLS bool, serverConfig, clientConfig *tls.Config, allowLoginWithoutTLS, noCloseSwitchboard, setPassword bool, accname string, afterInit func() error) *testconn {
 	limitersInit() // Reset rate limiters.
 
-	if first {
-		os.RemoveAll("../testdata/imap/data")
-	}
 	mox.Context = ctxbg
 	mox.ConfigStaticPath = filepath.FromSlash("../testdata/imap/mox.conf")
 	mox.MustLoadConfig(true, false)
+	if first {
+		store.Close() // May not be open, we ignore error.
+		os.RemoveAll("../testdata/imap/data")
+		err := store.Init(ctxbg)
+		tcheck(t, err, "store init")
+	}
 	acc, err := store.OpenAccount(pkglog, accname)
 	tcheck(t, err, "open account")
 	if setPassword {
@@ -358,33 +370,55 @@ func startArgs(t *testing.T, first, isTLS, allowLoginWithoutTLS, setPassword boo
 		switchStop = store.Switchboard()
 	}
 
+	if afterInit != nil {
+		err := afterInit()
+		tcheck(t, err, "after init")
+	}
+
 	serverConn, clientConn := net.Pipe()
 
-	tlsConfig := &tls.Config{
-		Certificates: []tls.Certificate{fakeCert(t)},
+	if serverConfig == nil {
+		serverConfig = &tls.Config{
+			Certificates: []tls.Certificate{fakeCert(t, false)},
+		}
 	}
-	if isTLS {
-		serverConn = tls.Server(serverConn, tlsConfig)
-		clientConn = tls.Client(clientConn, &tls.Config{InsecureSkipVerify: true})
+	if immediateTLS {
+		if clientConfig == nil {
+			clientConfig = &tls.Config{InsecureSkipVerify: true}
+		}
+		clientConn = tls.Client(clientConn, clientConfig)
 	}
 
 	done := make(chan struct{})
 	connCounter++
 	cid := connCounter
 	go func() {
-		serve("test", cid, tlsConfig, serverConn, isTLS, allowLoginWithoutTLS)
-		switchStop()
+		serve("test", cid, serverConfig, serverConn, immediateTLS, allowLoginWithoutTLS)
+		if !noCloseSwitchboard {
+			switchStop()
+		}
 		close(done)
 	}()
 	client, err := imapclient.New(clientConn, true)
 	tcheck(t, err, "new client")
-	return &testconn{t: t, conn: clientConn, client: client, done: done, serverConn: serverConn, account: acc}
+	tc := &testconn{t: t, conn: clientConn, client: client, done: done, serverConn: serverConn, account: acc}
+	if first && noCloseSwitchboard {
+		tc.switchStop = switchStop
+	}
+	return tc
 }
 
-func fakeCert(t *testing.T) tls.Certificate {
-	privKey := ed25519.NewKeyFromSeed(make([]byte, ed25519.SeedSize)) // Fake key, don't use this for real!
+func fakeCert(t *testing.T, randomkey bool) tls.Certificate {
+	seed := make([]byte, ed25519.SeedSize)
+	if randomkey {
+		cryptorand.Read(seed)
+	}
+	privKey := ed25519.NewKeyFromSeed(seed) // Fake key, don't use this for real!
 	template := &x509.Certificate{
 		SerialNumber: big.NewInt(1), // Required field...
+		// Valid period is needed to get session resumption enabled.
+		NotBefore: time.Now().Add(-time.Minute),
+		NotAfter:  time.Now().Add(time.Hour),
 	}
 	localCertBuf, err := x509.CreateCertificate(cryptorand.Reader, template, template, privKey.Public(), privKey)
 	if err != nil {