exttarget/server: new exttarget accepting server masks

Closes #267
exttarget/server: add to documentation
Merge pull request #268 from grawity/exttarget-server

exttarget/server: new exttarget accepting server masks
Mention pull request #268 in NEWS.md
saslserv/main: add support for impersonation using SASL authzid

This allows different "authentication" and "authorization" identities to
be specified in the SASL exchange (for mechanisms that support this,
e.g. PLAIN or EXTERNAL).

This means that a client can authenticate as one user but gain the
privileges of another, *if* the source user holds either the
"impersonate:any" or "impersonate:<class>" operclass privilege, where
<class> is the target user's operclass.

For example, a user having {impersonate:user; impersonate:helper} may
impersonate only regular users and "helper" services opers, but is not
allowed to specify users in other operclasses (e.g. SRAs).

The use case for this, as discussed with Jobe in #ircv3, is providing a
BNC service for your own network.  A regular BNC setup would need to
store Atheme credentials (password or certificate) for every BNC user.
With impersonation, the BNC only needs to authenticate to its own
account.
saslserv/{plain,external,authcookie}: store the authzid
saslserv/main: make use of the 'mu' parameter to sasl_logcommand
add feature to NEWS
Merge pull request #271 from grawity/sasl-impersonate

SASL "authorization identity" (impersonation) support
sasl: ensure saslserv/main:login_user() is a private symbol
sasl: use impersonate:class: namespace instead of impersonate: namespace for specific roles
sasl: implement `impersonate:entity` namespace part 1
sasl: use C99 boolean in may_authorize()
sasl: add hook: sasl_may_impersonate for other modules like groupserv
groupserv: provide a hook for sasl_may_impersonate

This hook checks privileges for every group a user is in in the `impersonate:entity:` namespace.
scripting: update code generator for sasl_may_impersonate hook
contrib/cap_sasl.pl: s/use/require/ inside eval blocks

If the module doesn't exist, 'use' causes a compile-time failure, which
defeats the purpose of using an eval{} here.

This has already been fixed in other sources of the script.
contrib/cap_sasl.pl: import fixes from freenode's 1.5

 - fall back to Crypt::DH::GMP::Compat on Ubuntu
 - ensure that the auth file is not world-readable
 - increase timeout to 7.5s
 - update the specification URL
contrib/cap_sasl.pl: add SASL EXTERNAL
contrib/cap_sasl.pl: add SASL ECDSA-NIST256P-CHALLENGE

Largely based on the version in atheme/ecdsatool, but with some minor
fixes like checking if the tool is in $PATH...