Provisioning /etc/dovecot/conf.d/*.conf is a pain on upgrade so we
consolidate that by reverting these files to the distro-provided ones
and shipping a single /etc/dovecot/conf.d/99-local.conf override
instead.

These days upstream's ‘mysql_user’ is good enough.

And drop -ldap from all roles other than MX.  -lmdb is included in
roles/common but it can be helpful to have it individual roles as well
as they can be run individually.

This provides better isolation opportunity as the service doesn't need
to run as ‘vmail’ user.  We use a dedicated system user instead, and
LDAP ACLs to limit its access to the strict minimum.

The new solution is also more robust to quoting/escaping, and doesn't
depend on ‘home=/home/mail/virtual/%d/%n’ (we might use $entryUUID
instead of %d/%n at some point to make user renaming simpler).

OTOH we no longer lists users that have been removed from LDAP but still
have a mailstore lingering around.  This is fair.

For `ssl_cipher_list` we pick the suggested value from
https://ssl-config.mozilla.org/#server=dovecot&version=2.3.9&config=intermediate&openssl=1.1.1d

At the moment it's equivalent (modulo order) to adding ‘EDH+AESGCM+aRSA’
to ‘EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL’.

Cf. lmdb_table(5).