Use modern TLS-related recommendations as per RFC7525, RFC7817, and RFC8314

[nevans]

[nevans]

This is a generic list of things I'd like to do. We should update the issue description with what's necessary for the recommendations in RFC7525, RFC7817, and RFC8314.

• Allow Net::IMAP.new(hostname, starttls: true) to automatically use STARTTLS when connecting to the plaintext port (and ignored when connecting with implicit TLS). This can be opportunistic or required.
• Introduce config settings that:
  • use implicit TLS by default when the port is unspecified
  • designate default behavior for non-standard ports:
    • implicit TLS
    • plaintext (with a warning)
    • plaintext (without any warning)
    • raise ArgumentError unless an explicit ssl or a standard port is provided
  • automatically use STARTTLS for plaintext ports. This can be opportunistic or required.
  • enforce TLS policies on #login and #authenticate: e.g: warn or raise an exception when called without #tls_verified?
  • enforce TLS policies based on SASL mechanism attributes
• Allow custom config defaults by hostname (or hostname:port). We can pre-populate this, similar to how browsers use a preloaded HTTP Strict-Transport-Security list:

  {
    "imap.gmail.com" => {
      default_port: :tls, unknown_ports_tls: true, starttls: :require,
      plaintext_authentication: :error,
    },
    "localhost" => {
      default_tls_port: true, unknown_ports_tls: false, starttls: :opportunistic,
      plaintext_authentication: :warn,
    }
  }

• Add mechanism-specific attributes to SASL authenticator classes which can be used to enforce TLS policies.
• Gradually (over at least two years / two major releases), update the default config so that Net::IMAP uses TLS by default. Eventually, the default config should only use plaintext for "localhost".