Many, many patches

```
List of things that will be done:

 [ ] Item has yet to be done
 [*] Item is done
 [-] Item is committed and compiles, but untested

-- shadowircd 6.4.0
* This is primarily made up of backports from Charybdis 3.4.0


SERVER PROTOCOL

 [*] Add channel ban forwarding <mask>$<channel> much like
     ircd-seven. Local use of this is controlled by the
     channel::use_forward config option.

 [*] Allow RSFNC (forced nick change from services) to change a
     nickname's capitalization only.

 [-] Add ENCAP TGINFO to propagate IP addresses that exceeded target
     change limits (these get a lower limit when they reconnect). The
     message's source is the user that exceeded the limit and one
     parameter "0" is required.


USER

 [*] Allow mode queries on mlocked modes. In particular, allow /mode
     #channel f to query the forward channel even if +f is mlocked.

 [*] Consider bogus CTCP ACTION messages (without action text) CTCP
     (for cmode +C).

 [*] Apply colour stripping (cmode +c) and CTCP checking (cmode +C)
     to messages to @/+ channel as well.

 [*] Channel mode +c (and other places that disallow colour codes)
     now also strip ASCII 4 (a different kind of colour code).

 [*] Add an error message (numeric 743) if a ban mask is invalid.

 [*] Extract the underlying IPv4 address from 6to4 and Teredo IPv6
     addresses. Show it in a remote /whois and check channel bans,
     quiets, D:lines and K:lines against it. Note that ban exceptions
     and auth{} blocks are not checked.

 [*] Send ERR_TOOMANYCHANNELS for each channel join that fails due to
     channel limits, instead of one per JOIN command.

 [-] Add account-notify client capability to notify clients about logins
     and logouts of users in common channels. See doc/account-notify.txt.

 [*] Add away-notify client capability. See doc/away-notify.txt.

 [-] Add extended-join client capability to add account name and ircname
     to JOIN. See doc/extended-join.txt.

 [*] Disallow mIRC italics in channel names when disable_fake_channels.

 [*] Add AUTHENTICATE EXTERNAL support, allows SASL authentication
     using an SSL certificate fingerprint.

 [ ] The NICKLEN token in 005 now only specifies the maximum nick length
     for this server/user. The MAXNICKLEN token specifies the maximum
     nick length any user can have.

 [*] Disallow '$' in usernames as this may cause problems with ban
     forwarding.

 [*] Allow normal users to perform /privs on themselves, showing some
     privileges from the auth{} block.

 [*] Rate limit high-bandwidth commands, in particular /who <channel>.

 [*] Rate limit /away to help avoid flooding via away-notify.

 [*] Reject nicks with '~' in them, rather than cutting at the first '~'


OPER

 [*] Add operspy for /list.

 [*] Add /stats C to show information about dynamically loaded server
     capabilities.

 [-] Add a server notice to snomask +b if a user exceeds target change limits.

 [*] Add missing server notice for kills from RSFNC and SVSLOGIN.
 
 [-] Make DNSBL hits global snotes instead of local snotes.


CONFIG

 [*] Add support for IPv6 DNSBLs. A new "type" option specifies the IP
     version(s) for which each DNSBL should be checked.

 [*] Make flood control settings configurable by those who know exactly
     what they are doing.

 [ ] Add serverinfo::nicklen config option to limit the nick length
     for local users. Different values of this option do not break the
     server protocol.

 [*] Add general::away_interval to allow configuring /away rate limiting.

 [-] Add listener::defer_accept to delay accepting a connection until
     the client sends data. This depends on kernel support. It may
     break BOPM checking.

 [*] Add general::resv_fnc to forcibly change nicks of local users that
     match a newly set nick RESV, default enabled.

 [*] Add extb_usermode extension, $m:+-<modes> extban matching against
     umodes.

 [*] Extend extb_oper extension to allow matching against oper
     privileges.


MISC

 [*] Add --with-custom-branding and --with-custom-version configure
     options to help forks/patchsets distinguish themselves.

 [*] Ensure SIGHUP and SIGINT keep working after a SIGINT restart.

 [*] Remove broken GnuTLS support. SSL/TLS is now only provided using
     OpenSSL.

```