templates: postfix: forbid_bare_newline on external port

templates: postfix: forbid_bare_newline on external port

This patch addresses the smtp-smuggling vulnerability [0,1], with the
recommended fix by postfix upstream [2].

Disallowing bare linefeeds instead of crlf should not be a problem
with any standards-compliant MTA.
The internal port allows bare linefeed, since internal clients
(mail-scripts written ages ago, some ancient embedded systems) might
not adhere to the protocol. Additionally the mail-proxy allowlist (the
ip and cidr entries, are the only ones applicable here) is also added
to the global exceptions.

Currently the updated postfix-packages are not published in the
security repositories but only as stable updates [3,4]
However postfix ignores unknown configuration parameters and only
prints a warning to the journal - so the changes to the templates can
already be shipped, for those users who have the stable-updates mirror
enabled.

Tested with the current postfix in bookworm, then updating to the one
in bookworm-updates and running tests with netcat (verified with nc -C
that it still works with the correct line-termination):
```
$ nc -6  pmgtest 25
220 pmgtest.proxmox.com ESMTP Proxmox
EHLO pmgsender.proxmox.com
521 5.5.2 pmgtest.proxmox.com Error: bare <LF> received
```

[0] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
[1] https://nvd.nist.gov/vuln/detail/CVE-2023-51764
[2] https://www.postfix.org/smtp-smuggling.html
[3] https://security-tracker.debian.org/tracker/CVE-2023-51764
[4] https://lists.debian.org/debian-stable-announce/2023/12/msg00004.html

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>