Roundcube: Use Mail-in-a-Box admin API to drive password changes

[ddavness]

Fixes #85 Related to mail-in-a-box/mailinabox#2185

The Mail-in-a-Box driver has a fallback mode where it can use the logged-in user's credentials to authenticate itself against the API. This is our next best solution (the first would be getting the root API key from /var/lib/mailinabox/api.key, but the driver does not support this and there isn't a fix we can do on our end).

Right now there are two problems with this approach:

• The endpoint used is admin-only (that means only admins can change their own password)
• • This is because this endpoint is used to change the password of any account. Fixable on our end; if the user does not have admin privileges it can only change their own password
• The authentication method used by the driver fails if the user has 2FA enabled
• • This is a security measure and I'm not willing to waive the 2FA part. The API as-is pretty much only allows admins to enroll in 2FA anyway, so they can still change their own password from within the admin panel, too. But removing 2FA from an admin user would keep their 2FA enrolment, and at this point they'd be unable to change their own password.
• • Solution: Allow non-admins to change their own passwords from within the admin panel (and also enroll in 2FA if they want to, but that's future work).

[ddavness]

Alright so we're at this point where everything is more or less implemented. I'll be leaving this PR open for comments for a day or two before merging.

The only thing that I see being potentially an issue is that if you have 2FA enabled, changing the password in Roundcube will not work anymore with a very unclear messaging ("Password could not be saved" or some line along that).

[kiekerjan]

I like the idea of using the MiaB API to change the user's password. I'm a bit out of my depth for reviewing that code though :( Is there much added value to adding 2FA for normal users? It is only applicable to the admin portal and not to mail access.

[ddavness]

Is there much added value to adding 2FA for normal users?

Right now? Not really. But later down the road when we figure out how to enforce 2FA everywhere, it'll start being useful for once.

It's more along the lines of "the work is already there, so it's not too much effort to bring it to normal users"