Add support for SASL EXTERNAL

This is a method to identify to nickserv during connection registration,
like SASL PLAIN, but using the fingerprint of the certificate. Currently
the method used is chosen based on the mere presence of a certificate.
SASL PLAIN is not used as fallback (either this works or the certificate
is used as normal, with the race condition).