Implement registering with an email support

[PiotrKozimor]

Support for registration via email sent by identity server. Resolves #1298, but there is a catch.
Test case Can register using an email address validates registration when dendrite itself sends verification email. In this PR dendrite sends /_matrix/identity/v2/validate/email/requestToken request to identity server (which will trigger sending email). New test case must be implemented in sytest. Proposed name: Can register using an email address via identity server

Allowable authentication flows must be passed via config file. This PR setups following convention (at the same time putting step towards removing Derived):

client_api:
  registration:
    flows:
      - stages:
        - m.login.email.identity
  login:
    flows:
      - stages:
        - m.login.password

What's left to do?

• Authenticate requests to identity server - I leave it with no authentication using V1 Identity API
• Verify identity server certificates - there is configuration to add custom CA to system certificate pool.
• Implement test case in sytest - PR

Pull Request Checklist

• I have added any new tests that need to pass to sytest-whitelist as specified in docs/sytest.md
• Pull request includes a sign off

Signed-off-by: Piotr Kozimor <p1996k@gmail.com>

[PiotrKozimor]

Regarding failing CodeQL checks - for both Uncontrolled data used in network request issue is reported while in fact identity server URI is checked against list of trusted ones.

[richvdh]

dendrite isn't my project, but:

this endpoint is deprecated by MSC2713 and it's likely that sydent will soon drop support for it.

In general, homeservers should not be delegating responsibility for email address validation to identity servers, since it allows a compromised ID server to be used to take over homeserver accounts.

[PiotrKozimor]

Thank you for comment. I think I have misunderstood concept of ID server. It makes sense that homeserver sends email on its own. So ID server would be user after registration to publish association, so that other may find user by email, right? I suppose also that auth stage for login should be also done without ID server. I am right?

[richvdh]

yes, that's right.

[PiotrKozimor]

Closing this as long as we want HS to send validation emails - see this issue.