Reject incoming DMARC reports without a DMARC pass

[mjl-]

DMARC reports sent by email MUST have an aligned DMARC pass (RFC 7489, 7.2.1.1). Some mail server operations send reports from hosts that don't have a DMARC pass (or even any SPF pass or any DKIM signatures). We are currently accepting those messages, but don't process the report because they are untrusted. We mark them as unread so the postmaster can look at them.

We should be rejecting these messages during the SMTP transaction with a helpful error message. This may cause a DSN to be delivered to the sending operator, hopefully causing them to fix their setup. The mox postmaster won't have to look at these messages anymore, won't have to contact the sender. The mox postmaster could still find these messages in the Rejects mailbox for a limited period, for investigation.