🔒🐛 Validate RawData and wait to continue literals

[nevans]

Important

This fixes a CRLF/command injection vulnerability for RawData, which is used by:

• #search and #uid_search send criteria as raw data, when it is a String
• #fetch and #uid_fetch send attr as raw data, when it is a String.
  When attr is an Array, its String members are sent as raw data.

Caution

RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

This parses a RawData string into an array of text, literal, and literal8 parts. In addition to blocking the CRLF injection vulnerability, this also fixes embedded literals so they correctly wait for server continuation request before sending. Binary and Non-synchronizing literals are also parsed and sent correctly.

This adds Net::IMAP::RawText which sends verbatim (like RawData did previously), and handles text validations:

• text can't contain CR, LF, or NULL
• text must be ASCII compatible or valid UTF-8

The existing Literal and Literal8 classes handle literal validation:

• literal can't contain NULL byte, but literal8 can

Additionally, RawData validates that:

• embedded literal bytesize must be <= remaining string bytesize
• final text cannot end with {number} (in case a CRLF comes after)

This does not make RawData arguments safe from every type of injection attack. However, without losing any significant flexibility, this does prevent unescaped CRLF from creating a command injection.