Mail flow rules: carry out the transport actions

Phase 2g of the DLP and mail flow rules spec: transport rules now act,
on outgoing and incoming mail.

- features/mailflow/rewrite.rs: add or remove a header, prefix or set the
  subject (an RFC 2047 word when not ASCII), add a disclaimer. A
  disclaimer edits the message's main text and HTML bodies only, each
  decoded, changed and written back as UTF-8 quoted-printable with its
  other headers kept, top or bottom (after <body> or before </body> in
  HTML); attachments and attached messages are left alone, and a
  disclaimer already present isn't added again.
- smtp/inbound/mailflow.rs: the check runs for incoming mail too
  (transport rules only; DLP stays outgoing). After DLP passes, each
  matched transport rule's actions run in order: message edits,
  add-recipient and redirect (envelope changes DATA applies), route (a
  per-message queue ahead of the queue strategy), refuse (550 5.7.1
  with the rule's text). The override tag is stripped with the same
  subject writer, so a non-ASCII subject stays valid.
- Audit: refusals and changes to where mail goes are recorded (sender,
  or system:mail-flow for incoming mail); wording and header changes
  aren't, or a banner rule would record every message (spec §2.7).

Tests: rewrite unit tests (headers, encoded subjects, disclaimers on a
single part and on multipart/alternative with an attachment, once
only); mail_rules_tests gains the actions end to end: disclaimer,
header and subject prefix on a delivered message, a redirect, a
refusal, a banner on incoming LMTP mail that outgoing rules leave
alone, and which of those are audited.

docs/spec/features/dlp-and-mail-flow-rules.md

@@ -312,8 +312,13 @@ the sender's reason. No new audit action was added: an older node reading a
 record with an action it doesn't know fails its daily clean-up, so a new
 action would make rolling back unsafe.
 
-Transport rules that change a message record the rule and action the same way.
-Unmatched mail writes nothing.
+Transport rules that refuse a message or change where it goes (redirect, add
+a recipient, route) record the rule and what it did the same way, the actor
+being the sender, or `system:mail-flow` for incoming mail. **As built
+(phase 2g)**, rules that only change wording or headers (a disclaimer, a
+header, a subject prefix) write nothing: a banner rule would otherwise write
+a record for every message, kept for the audit log's two years. Unmatched
+mail writes nothing.
 
 ### 2.8 Permissions and who does what