Support SASL2 FAST authentication

FAST is a cookie-style authentication method that
lets clients store and auth with an unguesseable token.
It enables clients to forget the user's full password,
which is especially important for web-based clients,
that are prone to data leaks. Leaked tokens can be
invalidated.

- https://xmpp.org/extensions/xep-0484.html
- https://xmpp.org/extensions/xep-0388.html

Intended to fix conversejs/converse.js#3144

Some aside changes I needed for this:
- I let handlers listen to the *opening* stanza
- Set 'from' on the opening <stream> tag. (ref: https://github.com/xmppjs/xmpp.js/pull/1006/files#r1893267922)
- Create a type of handler that can search *nested data*.
  This made setting up listeners a lot more convenient.
- During connection, replace has_features with
  the direct XML <stream:features>
  more direct and defensive.
- Moved Status.AUTHENTICATING before FAST/SASL

Still TODO:

- support the other HT- methods from the spec
- rewrite the SASL code into sasl.js to look like sasl2.js ?
- allow fallback from SASL2 to SASL (currently
  assumes only ONE login method will be tried per
  connect(), which could block login if one is failing)
- pull SASL2 into sasl2.js and make it a plugin
- Disentangle the circular dependency between
  index.js loading sasl2.js/sasl2_fast.js but them needing to talk to Strophe
- Invalidate token on logout
  (and in the corresponding Converse.js branch,
  actually forget the token on logout)

Author: kousu

src/bosh.js

@@ -146,6 +146,7 @@ class Bosh {
 
         const body = this._buildBody().attrs({
             'to': this._conn.domain,
+            ...(this._conn.service.startsWith("https://") ? { 'from': this._conn.jid } : {}),
             'xml:lang': 'en',
             'wait': this.wait,
             'hold': this.hold,
@@ -424,7 +425,7 @@ class Bosh {
             const req = this._requests.pop();
             req.abort = true;
             req.xhr.abort();
-            req.xhr.onreadystatechange = function () {};
+            req.xhr.onreadystatechange = function () { };
         }
     }
 
@@ -451,12 +452,13 @@ class Bosh {
                     if (data[i] === 'restart') {
                         body.attrs({
                             'to': this._conn.domain,
+                            ...(this._conn.service.startsWith("https://") ? { 'from': this._conn.jid } : {}),
                             'xml:lang': 'en',
                             'xmpp:restart': 'true',
                             'xmlns:xmpp': NS.BOSH,
                         });
                     } else {
-                        body.cnode(/** @type {Element} */ (data[i])).up();
+                        body.cnode(/** @type {Element} */(data[i])).up();
                     }
                 }
             }
@@ -482,10 +484,10 @@ class Bosh {
             if (time_elapsed > Math.floor(timeoutMultiplier * this.wait)) {
                 log.warn(
                     'Request ' +
-                        this._requests[0].id +
-                        ' timed out, over ' +
-                        Math.floor(timeoutMultiplier * this.wait) +
-                        ' seconds since last activity'
+                    this._requests[0].id +
+                    ' timed out, over ' +
+                    Math.floor(timeoutMultiplier * this.wait) +
+                    ' seconds since last activity'
                 );
                 this._throttledRequestHandler();
             }
@@ -627,7 +629,7 @@ class Bosh {
             req.abort = true;
             req.xhr.abort();
             // setting to null fails on IE6, so set to empty function
-            req.xhr.onreadystatechange = function () {};
+            req.xhr.onreadystatechange = function () { };
             this._requests[i] = new Request(req.xmlData, req.origFunc, req.rid, req.sends);
             req = this._requests[i];
         }
@@ -694,9 +696,9 @@ class Bosh {
         } else {
             log.debug(
                 '_processRequest: ' +
-                    (i === 0 ? 'first' : 'second') +
-                    ' request has readyState of ' +
-                    req.xhr.readyState
+                (i === 0 ? 'first' : 'second') +
+                ' request has readyState of ' +
+                req.xhr.readyState
             );
         }
     }
@@ -714,7 +716,7 @@ class Bosh {
             }
         }
         // IE6 fails on setting to null, so set to empty function
-        req.xhr.onreadystatechange = function () {};
+        req.xhr.onreadystatechange = function () { };
         this._throttledRequestHandler();
     }