Legal holds, step 1: the hold itself

inbuxa:LegalHold get/set places a hold on accounts, groups, domains,
tenants or the whole server, with an optional date range. A hold's range
and scope can only widen, a released hold is read-only, and none is ever
deleted. Placing, changing and releasing each need a reason and are
audited (LH-1, LH-3, LH-10, AU-12).

Permissions 669-672 (see, place, widen or release, export held data)
go to server administrators only; the tenant ceiling always strips them,
as it does Impersonate (LH-13). Schema: Compliance > Legal Holds.

What a hold keeps comes next, through the undelete hooks.

Also moves the lock expiry helpers below the lock module's imports.

crates/jmap/src/api/auth.rs

@@ -96,6 +96,7 @@ impl JmapAuthorization for AccessToken {
                 }
                 // inbuxa: account lock (AL-12)
                 GetRequestMethod::AccountLock(_) => Permission::SysAccountLockGet,
+                GetRequestMethod::LegalHold(_) => Permission::SysLegalHoldGet,
                 // inbuxa: legacy protocols off. It takes listeners away and
                 // puts them back, so it takes the listener's permissions
                 GetRequestMethod::ProtocolPolicy(_) => Permission::SysNetworkListenerGet,
@@ -222,6 +223,15 @@ impl JmapAuthorization for AccessToken {
                         Permission::SysAccountLockUpdate,
                         Permission::SysAccountLockDestroy,
                     ),
+                    // inbuxa: legal hold (LH-13); holds are never destroyed,
+                    // and the handler refuses a destroy outright
+                    SetRequestMethod::LegalHold(s) => validate_set(
+                        s,
+                        self,
+                        Permission::SysLegalHoldCreate,
+                        Permission::SysLegalHoldUpdate,
+                        Permission::SysLegalHoldUpdate,
+                    ),
                     SetRequestMethod::AuditVerification(s) => validate_set(
                         s,
                         self,
@@ -369,6 +379,7 @@ impl JmapAuthorization for AccessToken {
                 | MethodObject::AuditExport
                 | MethodObject::AuditVerification
                 | MethodObject::AccountLock
+                | MethodObject::LegalHold
                 | MethodObject::ProtocolPolicy
                 | MethodObject::TenantProtocolPolicy => Permission::JmapEmailChanges,
                 // inbuxa: x:MaskedEmail/changes reads what /get reads