alpaca mitigations

[elliefm]

Adds the following mitigations that prevent Cyrus IMAP servers being used in Application Layer Protocol Confusion (ALPACA) attacks, particularly against web browsers:

• connection is dropped after excessive consecutive basic syntax errors ("Invalid tag", "Null command", "Unrecognized command")
• tags cannot contain <> characters (prevents reflecting attacker-supplied HTML content in IMAP responses)
• tags cannot contain : characters (HTTP request header lines now count as basic syntax errors)
• the first command's tag cannot be one of the HTTP request methods that accepts a request body (connections from tricked web browsers will look like this)
• connection is dropped if the first command has an invalid tag, including the first command after STARTTLS is established

Fixes #5046

[elliefm]

(details subject to change after we get some data about what tags IMAP clients in the wild are sending to our servers)

[elliefm]

Needs #5126 to land first