saslserv/main: add support for impersonation using SASL authzid

This allows different "authentication" and "authorization" identities to
be specified in the SASL exchange (for mechanisms that support this,
e.g. PLAIN or EXTERNAL).

This means that a client can authenticate as one user but gain the
privileges of another, *if* the source user holds either the
"impersonate:any" or "impersonate:<class>" operclass privilege, where
<class> is the target user's operclass.

For example, a user having {impersonate:user; impersonate:helper} may
impersonate only regular users and "helper" services opers, but is not
allowed to specify users in other operclasses (e.g. SRAs).

The use case for this, as discussed with Jobe in #ircv3, is providing a
BNC service for your own network.  A regular BNC setup would need to
store Atheme credentials (password or certificate) for every BNC user.
With impersonation, the BNC only needs to authenticate to its own
account.
saslserv/plain: store the authzid
saslserv/authcookie: store the authzid
saslserv/external: store the authzid