security: E2EE and transport correctness (issue #147)

T04: promote security events to warnings — SASL auth failure, TLS
handshake failure, cert-failure details, see-other-host redirect;
DISABLE_TLS, TRUST_TLS and LEGACY_AUTH get a log warning plus a
console notice (REQ-LOG-01, REQ-LOG-02, REQ-AUTH-03)

T05: warn when a session ends up unencrypted without the user having
asked for it; refuse in-band registration on an unencrypted stream;
warn on each HTTP transfer with certificate verification disabled
(REQ-CRY-03, REQ-CFG-01)

T06: pin the update check to https with peer/host verification and no
redirects; strict N.N.N parser for the fetched version, which is
untrusted network input (REQ-VUL-02)

T09: no plaintext logging on failed MUC OMEMO sends; OTR opportunistic
first message passes allow_unencrypted_message(); get_random_string()
draws from a CSPRNG without modulo bias; guard the identity-key length
decrement against unsigned underflow (REQ-CRY-01, REQ-CRY-02,
REQ-CRY-07, REQ-MEM-05)

REQ-VUL-03 and REQ-CRY-09 are already satisfied on master and are
left unchanged.

tests/functionaltests/test_connect.c

@@ -92,3 +92,15 @@ connect_shows_presence_updates(void **state)
     );
     assert_true(prof_output_exact("Buddy1 (mobile) is xa, \"Gone :(\""));
 }
+
+void
+connect_warns_on_insecure_transport(void **state)
+{
+    /* the harness connects with "tls disable auth legacy": both downgrades must reach the console */
+    prof_connect();
+
+    prof_timeout(10);
+    assert_true(prof_output_exact("Security warning: TLS is disabled, this connection is unencrypted."));
+    assert_true(prof_output_exact("Security warning: legacy authentication is enabled for this connection."));
+    prof_timeout_reset();
+}