Merge commit from fork

With [smtp] ssl = False (the default) or [imap] ssl = False, mailsuite
upgraded the connection only if the server's plain-text EHLO/CAPABILITY
reply advertised STARTTLS, and otherwise authenticated in plain text. An
on-path attacker who stripped STARTTLS received the credentials and the
emailed results (CWE-319).

- Require mailsuite >= 2.3.4 (GHSA-2x4j-7g3q-wr6f), whose default
  refuses to authenticate over a connection that was not upgraded.
- Add [imap] and [smtp] starttls (unset = require STARTTLS; false =
  explicit plain-text opt-out, for loopback servers such as DavMail),
  with a startup warning when the opt-out is set and ssl is False.
- Add a starttls argument to email_results().
- Document both options; set starttls = False in the DavMail example.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

docs/source/davmail.md

@@ -183,7 +183,16 @@ config file:
 host=127.0.0.1
 port=1143
 ssl=False
+starttls=False
+
+[mailbox]
 watch=True
 ```
 
+The DavMail configuration above runs its IMAP listener without TLS
+(`davmail.ssl.nosecureimap=true`), so parsedmarc refuses to log in unless
+`starttls=False` allows plain-text authentication. Only set it when DavMail
+listens on the loopback address only (`davmail.bindAddress=127.0.0.1` and
+`davmail.allowRemote=false`, as above).
+
 [modern auth/multi-factor authentication]: https://davmail.sourceforge.net/faq.html