SMTP Header Injection Vulnerability in Bundled Legacy Library

## Issue: FINDING-080 - SMTP Header Injection Vulnerability in Bundled Legacy Library

**Labels:** bug, security, priority:medium, asvs-level:L2

**ASVS Level(s):** [L2-only]

**Description:**

### Summary
The `asfpy/messaging.py` module contains a legacy email sending function that constructs email messages using raw string formatting without proper CRLF sanitization. This allows SMTP header injection through multiple parameters including subject, sender, recipient, headers dict, and thread_key. An attacker could inject arbitrary email headers including Bcc, CC, Subject overrides, or Content-Type manipulation via CRLF sequences.

### Details
Affected locations in `asfpy/messaging.py`:
- Lines 130-140: Raw string interpolation for message construction
- Line 95: Subject parameter vulnerable
- Line 120: Headers dict vulnerable
- Line 110: Thread_key vulnerable

Additionally, the module uses assert statements for validation which are disabled with Python's `-O` flag. **Mitigating factor:** This module does not appear to be imported by any ATR application code - the application exclusively uses `atr/mail.py` for email operations.

### Recommended Remediation
**Preferred:** Remove `asfpy/messaging.py` from the repository if it's not needed, or clearly mark it as deprecated/unused.

**Alternative:** If the module must be retained, replace string formatting with Python's `email.message.EmailMessage` API:
- Use `EmailMessage(policy=policy.SMTPUTF8)`
- Use Address objects for From/To headers
- Use proper header assignment that automatically rejects CRLF sequences

Add a linting rule or import check that prevents importing `asfpy.messaging.mail` in any ATR module.

### Acceptance Criteria
- [ ] Legacy messaging module is removed or marked as deprecated
- [ ] If retained, SMTP header injection is prevented through proper API usage
- [ ] Linting rule prevents importing the legacy module
- [ ] Unit tests verify CRLF sequences are rejected

### References
- Source reports: L2:1.3.11.md
- Related findings: None
- ASVS sections: 1.3.11

### Priority
Medium