Make STARTTLS mandatory: support starttls.required in external.email #246

Problem

EmailClient never sets mail.smtp.starttls.required, so STARTTLS is opportunistic. When the server's EHLO reply does not advertise STARTTLS, javax.mail 1.4.7's SMTPTransport throws only if mail.smtp.starttls.required is true. Otherwise it continues in clear and goes on to AUTH.

An on-path attacker who strips STARTTLS from the EHLO reply therefore gets the SMTP credentials and the message in clear, and the certificate checks added in #206 never run. The current behaviour is documented (chap-mail.adoc: "If the server does not support STARTTLS, the connection continues without the use of TLS").

Raised as a follow-up in the #206 review.

Proposal

• Add an optional starttls.required setting to external.email, mapped to mail.smtp.starttls.required:

  props.put("mail.smtp.starttls.required",
          String.valueOf(starttlsConfig.get("required").defaultTo(false).asBoolean()));

• Decide the default. false keeps current deployments working. true is safe by default, but breaks servers that do not offer STARTTLS.

• Document it in chap-mail.adoc and keep it through the Admin UI save (see the starttls merge in EmailConfigView.save).

• Add a test in EmailClientTest.