The switch reports every change as an event (LP-8)

Turning legacy mail protocols off or back on raises
security.legacy-protocols-changed (id 643, info level, also in the packaged
schema), with the scope (policy = server), the new value, who made the
change (accountId), whether listeners closed or reopened (details), which
ones (listenerId), and -- only when a listener could not be put back --
which and why (reason).

It is raised in Server::set_protocol_policy rather than by the JMAP
method, so whatever turns the switch is reported. A /set that changes
nothing -- the switch already where it was asked to be, nothing to close
or reopen -- is not a change and raises nothing.

The event is never an error, but jmap's exhaustive map from security
events to HTTP errors has to name it; it joins the other two that can't
occur there. rustfmt now also wraps LP-6's two over-long lines in
enums_impl.rs, which it flagged along with this change's.

tests/e2e/legacy_protocols.py now gives the server a stdout tracer and
reads events from the container's log: turning the switch off is exactly
one event naming the scope, value, author and listeners closed; setting it
off again raises none; turning it on is one event naming the listeners
reopened. It also proves LP-6's side: seven refused submission sign-ins
are seven auth.legacy-protocol-refused events, and there is no auth.failed
or auth.too-many-attempts among them. All checks pass.

crates/common/src/network/legacy.rs

@@ -107,6 +107,37 @@ impl Server {
 
         protocol_policy::set(&self.core.storage.data, &policy).await?;
 
+        // LP-8. Raised here rather than by the JMAP method, so whatever turns
+        // the switch is reported. A /set that changed nothing -- the switch
+        // already where it was asked to be, nothing to close or reopen -- is
+        // not a change.
+        if previous.legacy_protocols != policy.legacy_protocols || !change.is_empty() {
+            let (moved, direction) = if policy.legacy_protocols.is_disabled() {
+                (&change.closed, "closed")
+            } else {
+                (&change.reopened, "reopened")
+            };
+            trc::event!(
+                Security(trc::SecurityEvent::LegacyProtocolsChanged),
+                Policy = "server",
+                Value = if policy.legacy_protocols.is_disabled() {
+                    "disabled"
+                } else {
+                    "enabled"
+                },
+                AccountId = policy.changed_by.clone(),
+                Details = direction,
+                ListenerId = listener_names(moved.iter().map(|l| l.id.clone())),
+                // Only when a listener could not be put back (LP-5).
+                Reason = (!change.failed.is_empty()).then(|| listener_names(
+                    change
+                        .failed
+                        .iter()
+                        .map(|(l, why)| format!("{}: {why}", l.id))
+                )),
+            );
+        }
+
         Ok(change)
     }
 
@@ -220,6 +251,12 @@ impl Server {
     }
 }
 
+/// Names for an event field: the listeners a change closed, reopened or
+/// failed to reopen (LP-8).
+fn listener_names<T: Into<trc::Value>>(names: impl Iterator<Item = T>) -> trc::Value {
+    trc::Value::Array(names.map(Into::into).collect())
+}
+
 /// A protocol a mail app signs in over, which the switch refuses (LP-6).
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum LegacyProtocol {