implement the plus variants of scram, to bind the authentication exchange to the tls connection

to get the security benefits (detecting mitm attempts), explicitly configure
clients to use a scram plus variant, e.g. scram-sha-256-plus. unfortunately,
not many clients support it yet.

imapserver scram plus support seems to work with the latest imtest (imap test
client) from cyrus-sasl. no success yet with mutt (with gsasl) though.

imapclient/client.go

@@ -16,6 +16,7 @@ package imapclient
 
 import (
 	"bufio"
+	"crypto/tls"
 	"fmt"
 	"net"
 	"reflect"
@@ -117,6 +118,15 @@ func (c *Conn) xcheck(err error) {
 	}
 }
 
+// TLSConnectionState returns the TLS connection state if the connection uses TLS.
+func (c *Conn) TLSConnectionState() *tls.ConnectionState {
+	if conn, ok := c.conn.(*tls.Conn); ok {
+		cs := conn.ConnectionState()
+		return &cs
+	}
+	return nil
+}
+
 // Commandf writes a free-form IMAP command to the server.
 // If tag is empty, a next unique tag is assigned.
 func (c *Conn) Commandf(tag string, format string, args ...any) (rerr error) {