Unify forensic and aggregate report delivery in opendmarc-reports

[thegushi]

Summary

• ReportCommand can be pointed at opendmarc-reports --forensic instead of sendmail -t to get features that are hard to do in C (SMTP AUTH, SSL/TLS, VERP), but --forensic mode had drifted from the aggregate path: it skipped NoReportsList and the suppressions table, and never applied SMTP AUTH/SSL despite the manpage already claiming both modes shared those settings.
• Added shared skip_reason() and smtp_connect() helpers so NoReportsList, StaleMARC, the suppressions table, and SMTP AUTH/SSL apply identically to both aggregate and --forensic delivery, instead of two paths that can silently drift apart.
• Added --archive-dir to save a copy of every outbound report (the full message as handed to SMTP, not just the gzipped XML or AFRF attachment) for later RFC-compliance review. Applies to both modes; suppressed and --test-mode reports are not archived.
• ReportCommand now distinguishes "all recipients suppressed" (exit 2, logged at LOG_INFO) from an actual delivery failure (exit 1, logged at LOG_ERR) -- previously both cases were indistinguishable in the logs.
• Fixed opendmarc.conf.sample, which still described NoReportsList's two-way semantics from before fix: implement @-sigil semantics for NoReportsList #404; documented the ReportCommand handoff to opendmarc-reports --forensic in both the sample and the manpage.

Test plan

• perl -c on reports/opendmarc-reports.in (with @Version@/@SQL_BACKEND@ substituted, since the .in template isn't valid Perl on its own)
• mandoc -Tlint on opendmarc.conf.5.in and opendmarc-reports.8.in
• Not compiled locally: libmilter isn't available on macOS, so opendmarc.c/opendmarc.h changes are reviewed by inspection only
• Not exercised against a live SMTP server (AUTH/SSL/VERP/archive-dir code paths)