do not disable xz/lzma for now despite being deprecated

dovecot updated to 2.3.16, pigeonhole to 0.5.16
fix CVE-2021-33515 plaintext commands injection (#1980014)

fix CVE-2020-24386 IMAP hibernation function allows mail access (#1913534)

fix CVE-2020-25275 denial of service via mail MIME parsing (#1914019)

change run directory from /var/run to /run (#1805947)

fix mail storage block count parsing (#1894418)
MIME parser crashed when boundaries were wrong (#1888111)

multilib compatibility (#1853137)

fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)
fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)
fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)

fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)
fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines
after-free (#1840357)
fix CVE-2020-10967 dovecot: sending mail with empty quoted localpart

fix default attributes for ghost files

dovecot updated to 2.3.8 with pigeonhole updated to 0.5.8 (#1653117)

fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte

reset errno before iterating through users (#1630410)

fix CVE-2019-3814: improper certificate validation (#1674370)

do not print error message when restorecon is not present
change default config to use minimal UID = 1000 (#1630410)

use OpenSSl implementation of HMAC, disable CRAM-MD5 when FIPS is enabled (#1618749)