client: Group SASL EXTERNAL under SASL, test cap

Move the "SASL EXTERNAL" notice into the "Use SASL Authentication"
group box.  This makes it more clear that "SASL EXTERNAL" is only used
when SASL is enabled.

Change the SASL IRCv3 capability check to look for SASL PLAIN for
username/password authentication, and SASL EXTERNAL for SSL
certificate authentication.  Update the Details... dialog box info to
match.

This should hopefully address some confusion about when SASL is
actually in use, versus things like NickServ certificate fingerprint
sign-in.

Change the wording for SASL EXTERNAL from "Supported by network" to
"May be supported by network", as SASL v3.1 does not provide in the
capability negotiation message which SASL variants are supported.
SASL EXTERNAL seems less common than SASL PLAIN.