prevent unicode-confusion in password by applying PRECIS, and username/email address by applying unicode NFC normalization

an é (e with accent) can also be written as e+\u0301. the first form is NFC,
the second NFD. when logging in, we transform usernames (email addresses) to
NFC. so both forms will be accepted. if a client is using NFD, they can log
in too.

for passwords, we apply the PRECIS "opaquestring", which (despite the name)
transforms the value too: unicode spaces are replaced with ascii spaces. the
string is also normalized to NFC. PRECIS may reject confusing passwords when
you set a password.

main.go

@@ -33,6 +33,7 @@ import (
 	"time"
 
 	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/text/secure/precis"
 
 	"github.com/mjl-/adns"
 
@@ -1246,6 +1247,8 @@ The password is read from stdin. Its bcrypt hash is stored in a file named
 	}
 
 	pw := xreadpassword()
+	pw, err := precis.OpaqueString.String(pw)
+	xcheckf(err, `checking password with "precis" requirements`)
 	hash, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.DefaultCost)
 	xcheckf(err, "generating hash for password")
 	err = os.WriteFile(path, hash, 0660)