[security] Passwords may be sent in plaintext despite user configuration asking for use of `STARTTLS`

[hartwork]

The related line in code is this:

offlineimap3/offlineimap/imapserver.py

Line 329 in db34745

if 'STARTTLS' in imapobj.capabilities and not self.usessl:

It's the exact same (unfixed) issue as OfflineIMAP/offlineimap#669 re-created for visibility.

CC @duesee @chris001 @hannob

[etbuira]

The issue were broader than that, it could completely skip starttls even if both enabled in conf and advertised by server.
Fixed in imapmirror.