feat: add support for logging in using an email & password

[Fleeym]

Very much work-in-progress, I'm creating the PR now to get my thoughts in order.

This PR will add full support for email registration, with all required flows alongside it.

Will keep updating the text as I get more ideas / as the PR develops.

Constraints

• Current accounts are not forced to link their email address.
• Accounts that use an email to register will not be forced to link their GitHub.
• Email addresses will not be publicly available. Any such occurrence is considered a bug and will be patched.
• Email addresses can be filtered through a domain blocklist. Index will use the disposable email blocklist.
• If a used email address starts appearing in the blocklist after it has been associated to an account, the index will not require an email change.

New dependencies

Tried to be as conservative as possible, but it's better to not reinvent the wheel for those.

• Added lettre for sending emails.
• Added argon2, phc and constant_time_eq for password hashing (authentication tokens still use sha256, for now it should be sufficient)
• Added maud and html2text for email template writing (emails are sent as HTML and plaintext generated from said HTML). Emails are extremely basic, will probably stay that way.
• Added idna for correctly parsing unicode domains and converting them to punycode

Checklist

• Backwards compatible with currently existing GitHub accouts
• Offer an email / password setup flow
  1. User starts the setup flow, with email, password & password confirm
  2. Send confirmation email with a nonce to the address provided, it contains a URL to a frontend route
  3. Frontend POST calls the verify URL with the nonce received in query params
• Offer an email change flow
  1. User starts the setup flow, with the new email and current password, must be already authenticated
  2. Send confirmation email with a nonce to the new address provided, it contains a URL to a frontend route
  3. Frontend POST calls the verify URL with the nonce received in query params
  4. Update email, store audit entry, send notification to old email
• Offer a password change flow
• Offer TOTP configuration (could be pushed to later date, this is a fat PR as is)
• Register flow
  • Must be rate-limited
  • Must have email verification
  • Auto-wipe accounts that haven't verified their email after 30 days
• Offer a way to link GitHub for email-only accounts
• Handle a newly made GitHub account's username being already taken on the index (just concat digits to it or something)
• Handle email-only account avatars on website
• Update privacy policy to include email storage
• Remove Soggy Mod