SASL "authorization identity" (impersonation) support

This allows different "authentication" and "authorization" identities to be specified in the SASL exchange (for mechanisms that support this, e.g. PLAIN or EXTERNAL).

This means that a client can authenticate as one user but log in (gain privileges) as another, *iif* the source user holds either the <code>impersonate:any</code> or <code>impersonate:<i>targetclass</i></code> privilege, the latter matching the target user's operclass.

For example, an account having `privs { impersonate:user; impersonate:helper; }` may impersonate only regular users and "helper" services opers, but is not allowed to specify users in other operclasses (e.g. SRAs).

The use case for this, as discussed with Jobe in #ircv3, is providing a BNC service for your own network.  A regular BNC setup would need to store Atheme credentials (password or certificate) for every BNC user. With impersonation, the BNC only needs to authenticate to its own account. (Of course, this assumes that the BNC account names always match the Atheme account names, rather than being user-chosen.)