This does *not* add context propagation, just a span representing
the client-side Authenticate call.

IP-based blacklists should run anyway in that case. The change
simplifies the doAuthenticate() flow, and the ratelimit API.

Add a test for this case too.

Meant to simplify debugging.

The correct code is also easier to read.

Used for services that require authentication with the primary user
password regardless of any other configuration option.

Some services (e.g. smtp auth) don't provide us with a device ID.
Ignoring the rest of the information, such as the IP, prevents ratelimits
and blacklists from working.

The auth_client C library writes padded url-base64-encoded data.

Return all supported 2FA mechanisms in the authentication response

See merge request !6

Currently the only part that can fail is the U2F registration
decoding. As a side effect of validating user objects early, it also
gets rid of runtime allocations by just storing a map of backend.User
objects.

Measure latency of the authentication requests (only the ones where we
actually perform encryption).

This should make the server code more readable by disentangling it
from the backend implementation.

SQL support

See merge request !4

This first version (with tests) only supports the SQLite driver.

It wasn't updated after the config refactoring.