Security fixes for webmail and emailDelivery apps

- Fix command injection in relay config: use shlex.quote() on all
  subprocess arguments passed to mailUtilities.py
- Fix XSS in email reply/forward: html.escape() on From/To/Date/Subject
  headers before embedding in quoted HTML
- Fix attachment filename traversal: use os.path.basename() and strip
  null bytes from attachment filenames
- Fix Sieve script name injection: sanitize names to alphanumeric chars
- Fix SSRF in image proxy: resolve hostname to IP and check against
  ipaddress.is_private/is_loopback/is_link_local/is_reserved
- Remove internal error details from user-facing responses
- Update Access Webmail link from /snappymail/ to /webmail/

mailServer/templates/mailServer/index.html

@@ -112,7 +112,7 @@
                         </div>
                         
                         <div class="col-md-3 btn-min-width">
-                            <a href="/snappymail/index.php" title="{% trans 'Access Webmail' %}"
+                            <a href="/webmail/" title="{% trans 'Access Webmail' %}"
                                class="tile-box tile-box-shortcut btn-primary">
                                 <div class="tile-header">
                                     {% trans "Access Webmail" %}