Import upstream v0.16.25, stripped

Upstream commit: 3f657330c0f49a015a3a372fb59669b5cccbca6d
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 118 in 50 files
Dangling module declarations removed: 5
Edits turning enterprise off: 25
Third-party code: 14 files, 0 not in THIRD-PARTY.md
Renamed identifiers: 67 in 19 files
Verification: clean

The same Enterprise footprint as v0.16.24. The build check is clean
apart from the expected errors in the rebuilt-feature tests. A
bug-fix release: DKIM rotation, IMAP failed-login answers, DNSBL
multi-code scoring and negative TTLs, Pyzor on short messages, queue
quotas with an empty match, RocksDB info-log rotation, and
Autodiscover schema handling.

tests/src/system/antispam.rs

@@ -209,6 +209,14 @@ pub async fn test(test: &mut TestServer) {
     assert_eq!(samples.iter().filter(|x| x.1.is_spam).count(), 11);
     assert_eq!(samples.len(), 20);
 
+    // Removing the duplicate sample of a reclassified email should not remove the blob of the kept sample
+    for (id, sample) in &samples {
+        assert!(
+            client.download(&sample.blob_id.to_string()).await.is_ok(),
+            "blob of sample {id} is not accessible"
+        );
+    }
+
     // Adding a training sample without permissions should fail
     assert_eq!(
         account