Fix wait min/max setting
Cosmetic: correct debug output for UNEXPANDED_TIME
Add an option to randomise message delivery order
Add per-connection message limit
Return 554 instead of 501 on inbound TLS failure

RFC 3207 doesn't actually say what to do in this situation (except that
SSL_get_peer_certificate failure should probably result in 554, since
   If the SMTP server decides that the level of authentication or
   privacy is not high enough for it to continue, it SHOULD reply to
   every SMTP command from the client (other than a QUIT command) with
   the 554 reply code (with a possible text string such as "Command
   refused due to lack of security").
), but 501 is "Syntax error in parameters or arguments", which should be
used for SMTP syntax problems and doesn't really fit our failures
here. 554 is "Transaction failed", which seems more appropriate.
Default SSL timeouts to 5 minutes

Blocking SSL calls result in poor behaviour (connections that hang
around for days), so we should default to a sane timeout.
Clean up TLS config variables

I believe _TIMER is for firing events
(RECEIVE_ACCEPTED_MESSAGE_TIMER), while this is a timeout like the
rest.

0 has meaning, is documented in simta.conf, and should be allowed.
Fix TLS RED rules
Cosmetic: fix typos
Fix punt RED rules
Cosmetic: s/supress/suppress/

This has been bugging me for a while.
Change punt behaviour when QUEUE_INCOMING_SMTP_MAIL is set

QUEUE_INCOMING_SMTP_MAIL suppressed delivery but not punting, so
everything was immediately punted.
Add subject alternative name parsing

This is where the list of DNS names for the certificate lives; relying
on the cert subject is a legacy fallback only.

Mainly putting this in because I already had the code. We don't do
anything with this data yet, but a stricter SSL policy would need it.
Make smtpconnect slightly smarter