Rename the identifiers that carried the upstream name

Everything clients, users and operators meet now carries the fork's name,
with no aliases (SPEC.md §2.4, changed here from "protocol identifiers
stay"):

- JMAP: upstream's registry capability is urn:inbuxa:jmap:registry, beside
  the fork's own urn:inbuxa:jmap.
- WebDAV lock and sync tokens are urn:inbuxa:dav*; clients resync once.
- Sieve: vnd.inbuxa.while and vnd.inbuxa.expressions. sieve-rs spells these
  into its compiler, so it's vendored (vendor/sieve-rs, 0.7.3) and patched in;
  a unit test fails if Cargo.lock ever moves past the vendored copy. The
  trusted runtime now names itself too, rather than answering sieve-rs's
  default.
- The web interface's OAuth client is inbuxa-webui. On every start the old
  stalwart-webui client is removed and any application naming it is moved
  over.
- The spam filter's blobs are INBUXA_SPAM_*; every start moves any left
  under the old keys, so a trained model survives.
- SQL stores and log files default to inbuxa, in the code and in the
  schema served to the admin (checksum regenerated).
- Settings are INBUXA_* only. A STALWART_* variable that's set where its
  INBUXA_* one isn't stops the server at startup, naming it.
- The version-upgrade messages link docs.inbuxa.org's migration page, and
  the OpenAPI description, smtp crate metadata and web-push test fixtures
  lose the name.

Kept on purpose, allowlisted with reasons: the OAuth key-derivation
contexts (renaming them would end every session and invalidate every
sealed client id) and the hashed application prefix.

Also fixes a latent start-up failure: ensure_client updated an existing
first-party client with a revision of 0, which the registry's assertion
never matches, so adding a redirect URI or changing the webmail secret
failed start-up. And the principal session test now expects
legacyProtocols (C-1, added 2026-09-21), which it had missed.

Tested: the server builds without warnings; common's 106 unit tests,
including the vendoring check; a new integration test for the two
start-up migrations; and the webdav, jmap, imap and SMTP Sieve suites.

vendor/sieve-rs/src/runtime/actions/action_include.rs

@@ -0,0 +1,53 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs Ltd <[email protected]>
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::sync::Arc;
+
+use crate::{
+    Context, Event, Script, Sieve,
+    compiler::grammar::actions::action_include::{Include, Location},
+    runtime::RuntimeError,
+};
+
+pub(crate) enum IncludeResult {
+    Cached(Arc<Sieve>),
+    Event(Event),
+    Error(RuntimeError),
+    None,
+}
+
+impl Include {
+    pub(crate) fn exec(&self, ctx: &Context) -> IncludeResult {
+        let script_name = ctx.eval_value(&self.value);
+        if !script_name.is_empty() {
+            let script_name = if self.location == Location::Global {
+                Script::Global(script_name.to_string().into_owned())
+            } else {
+                Script::Personal(script_name.to_string().into_owned())
+            };
+
+            let cached_script = ctx.script_cache.get(&script_name);
+            if !self.once || cached_script.is_none() {
+                if ctx.script_stack.len() < ctx.runtime.max_nested_includes {
+                    if let Some(script) = cached_script
+                        .or_else(|| ctx.runtime.include_scripts.get(script_name.as_str()))
+                    {
+                        return IncludeResult::Cached(script.clone());
+                    } else {
+                        return IncludeResult::Event(Event::IncludeScript {
+                            name: script_name,
+                            optional: self.optional,
+                        });
+                    }
+                } else {
+                    return IncludeResult::Error(RuntimeError::TooManyIncludes);
+                }
+            }
+        }
+
+        IncludeResult::None
+    }
+}