Allow authentication on a tunnel connection

It's nice to set up an ssh tunnel command which simply forwards an IMAP tcp port, e.g. with ssh's "-W" flag. In this case, though, the tunnelled connection still requires authentication.

mbsync / isync support this use case, and this commit allows offlineimap to do the same.

In short, when a `tunnel` command is present, the presence of a `remoteuser` value will cause authentication to take place on the tunnel. (This generally requires also that `remotehost` is set, in order for the user's password to be looked up in .netrc.)

The downside of this change is that to use an unauthenticated tunnel (as all existing configured tunnels will be) the user must presumably omit the remoteuser key, and so some users may need to adjust their configuration files accordingly.

Example configuration:

```
[Repository Remote]
type = IMAP
preauthtunnel = ssh -C -W localhost:143 mail.example.com
remotehost = mail.example.com
remoteuser = user@example.com
```