also unicode-normalize usernames (email addresses) when logging into the imapserver and webapps

and don't do needless normalization for the username we got from scram: the
scram package would have failed if the name wasn't already normalized.

unicode may not be specified for sasl with imap (i'm not sure), but there's no
point in accepting it over smtpserver but not in imapserver.

webauth/webauth.go

@@ -45,6 +45,8 @@ import (
 	"strings"
 	"time"
 
+	"golang.org/x/text/unicode/norm"
+
 	"github.com/mjl-/sherpa"
 
 	"github.com/mjl-/mox/metrics"
@@ -266,6 +268,7 @@ func Login(ctx context.Context, log mlog.Log, sessionAuth SessionAuth, kind, coo
 		return "", &sherpa.Error{Code: "user:error", Message: "too many authentication attempts"}
 	}
 
+	username = norm.NFC.String(username)
 	valid, disabled, accountName, err := sessionAuth.login(ctx, log, username, password)
 	la := loginAttempt(r, kind, "weblogin")
 	la.LoginAddress = username