feat!: DKIM verifier

[j-g00da]

This implements a DKIM verification as well as a strict
DKIM signature alignment check with domain in From
header address.

Caches the retrieved RDATA using in-memory LRU.

BREAKING CHANGE: incoming messages now require DKIM signatures
aligned to domain of the From header address.

Signed-off-by: Jagoda Ślązak jslazak@jslazak.com

[j-g00da]

Few notes:

• I'm yet to create some meaningful test suite for this
• This passes relay tests: feat: replace DKIM verification with filtermail v0.4 relay#831 (isolated chatmaild tests are expected to fail, as they don't expect filtermail to reject on missing DKIM sig)
• Also tested manually using franky.testrun.org and record hosted on my own relay here: https://chat.kamiokan.de/.well-known/_domainkey/opendkim
• I didn't use viadkim's hickory-resolver feature, as this integration uses an old hickory-resolver version + I had to implement my own lookup anyway for the fallback mechanism. We should probably do some maintenance work on viadkim fork, and release it with some different name.

[j-g00da]

TODO:

• remove current http TXT caching based on TTL
• store only RDATA in selector file, since we don't need TTL
• implement LRU cache for RDATA returned by both DNS resolver and https requests, cache up to forever (in-memory)

[j-g00da]

Also:

• prevent memory exhaustion DoS by limiting response size... (Add response size limit 2 seanmonstar/reqwest#1855, Restrict the body sizes of responses LemmyNet/activitypub-federation-rust#23)

[j-g00da]

Removed the fallback mechanism, as it is no longer needed.

[link2xt]

Cache invalidation is a difficult problem as usual.

Should be mostly fine with this approach, we can improve later if needed.

chatmail always uses the same selector (opendkim) and there are servers that do rotation by iterating between two selectors so current approach will fail one message on every rotation or server resetup, but it's not a big deal, arguably reusing selectors is wrong. We can at least fix chatmail to always generate a new selector for each new setup.