Allow Phabricator to be configured to use a public Reply-To address

Summary:
We already support this (and Facebook uses it) but it is difficult to configure
and you have to write a bunch of code. Instead, provide a simple flag.

See the documentation changes for details, but when this flag is enabled we send
one email with a reply-to like "D2+public+23hf91fh19fh@phabricator.example.com".
Anyone can reply to this, and we figure out who they are based on their "From"
address instead of a unique hash. This is less secure, but a reasonable tradeoff
in many cases.

This also has the advantage over a naive implementation of at least doing object
hash validation.

@jungejason: I don't think this affects Facebook's implementation but this is an
area where we've had problems in the past, so watch out for it when you deploy.
Also note that you must set "metamta.public-replies" to true since Maniphest now
looks for that key specifically before going into public reply mode; it no
longer just tests for a public reply address being generateable (since it can
always generate one now).

Test Plan:
Swapped my local install in and out of public reply mode and commented on
objects. Got expected email behavior. Replied to public and private email
addresses.

Attacked public addresses by using them when the install was configured to
disallow them and by altering the hash and the from address. All this stuff was
rejected.

Reviewed By: jungejason
Reviewers: moskov, jungejason, tuomaspelkonen, aran
CC: aran, epriestley, moskov, jungejason
Differential Revision: 563

src/docs/configuration/configuring_inbound_email.diviner

@@ -65,6 +65,15 @@ over).
 If you leak a bunch of reply-to addresses by accident, you can change
 ##phabricator.mail-key## in your configuration to invalidate all the old hashes.
 
+You can also set ##metamta.public-replies##, which will change how Phabricator
+delivers email. Instead of sending each recipient a unique mail with a personal
+reply-to address, it will send a single email to everyone with a public reply-to
+address. This decreases security because anyone who can spoof a "From" address
+can act as another user, but increases convenience if you use mailing lists and,
+practically, is a reasonable setting for many installs. The reply-to address
+will still contain a hash unique to the object it represents, so users who have
+not received an email about an object can not blindly interact with it.
+
 NOTE: Phabricator does not currently attempt to verify "From" addresses because
 this is technically complex, seems unreasonably difficult in the general case,
 and no installs have had a need for it yet. If you have a specific case where a
@@ -190,11 +199,11 @@ content of the email to Phabricator:
   import logging, subprocess
   from lamson.routing import route, stateless
   from lamson import view
-  
+
   PHABRICATOR_ROOT = "/path/to/phabricator"
   PHABRICATOR_ENV = "custom/myconf"
   LOGGING_ENABLED = True
-  
+
   @route("(address)@(host)", address=".+")
   @stateless
   def START(message, address=None, host=None):