SASL "authorization identity" (impersonation) support

This allows different "authentication" and "authorization" identities to be specified in the SASL exchange (for mechanisms that support this, e.g. PLAIN or EXTERNAL).

This means that a client can authenticate as one user but gain the privileges of another, *if* the source user holds either the <code>impersonate:any</code> or <code>impersonate:<i>targetclass</i></code> privilege, the latter matching the target user's operclass.

For example, an account having `privs { impersonate:user; impersonate:helper; }` may impersonate only regular users and "helper" services opers, but is not allowed to specify users in other operclasses (e.g. SRAs).

The use case for this, as discussed with Jobe in #ircv3, is providing a BNC service for your own network.  A regular BNC setup would need to store Atheme credentials (password or certificate) for every BNC user. With impersonation, the BNC only needs to authenticate to its own account.