dcaccount for servers with self-signed certificates

Relays with self-signed certificates (madmail, https://github.com/chatmail/relay/pull/919) currently use `dclogin` scheme to disable TLS checks permanently.

The result of this is that:
1. OpenSSL is used instead of Rustls. This was only meant for nauta.cu support with its RSA1024 keys which Rustls is not going to support.
2. There is no protection against active attacks, it is trivial to MITM the connection and then monitor the mailbox with remembered credentials afterwards: https://support.delta.chat/t/tls-requirements-why-not-self-signed/5077/3
3. Proxy cannot be used, using proxy enables strict TLS checks because proxies are not trusted. It could work by remembering SPKI hash since https://github.com/chatmail/core/pull/8086, but we don't remember SPKI hash in the first place because OpenSSL is used and the code for saving it is for Rustls.
4. Users scan the same `dclogin` multiple times: https://github.com/chatmail/relay/pull/919#issuecomment-4350426968
5. `dclogin` allows to only configure one port for IMAP and one port for SMTP
6. In most cases `dclogin` does not specify `is` and `ss` parameters for IMAP and SMTP security, this results in trying both implicit TLS and STARTTLS on the same port (https://github.com/chatmail/core/blob/6e04993e75778a897cd66de971f78b31577e2e0b/src/configure/server_params.rs#L108-L120). Because in STARTTLS server talks (sends a banner) first and in implicit TLS client talks (sends TLS ClientHello), when STARTTLS is tried against implicit TLS port, connection times out after 1 minute. This is the problem in https://github.com/chatmail/relay/pull/919 at the moment, madmail 0.47.0 even explicitly generates `is=default` and `ss=default` for implicit TLS ports. cmlxc copied this too: https://github.com/chatmail/cmlxc/blob/277c921e899bfe83d8515f9e9ebc7b9278bd2c67/src/relay_minitest/support.py#L163

With https://github.com/chatmail/core/pull/8086 key hash is remembered when TLS certificate is valid, the only problem is getting SPKI hash into storage for new domains and IP addresses. Can either extend `dcaccount` if it can be made compatible (probably not) or introduce another scheme with a place to put SPKI hash. It should then either be stored or passed around during the configuration, so autoconfig XML can be fetched (which is needed to configure multiple ports).