Build separate mail for each recipient, honoring recipient access levels

Summary:
Ref T6367. Removes multiplexMail()!

We can't pass a single body into a function which splits it anymore: we need to split recipients first, then build bodies for each recipient list. This lets us build separate bodies for each recipient's individual translation/access levels.

The new logic does this:

• First, split recipients into groups called "targets".
  • Each target corresponds to one actual mail we're going to build.
  • Each target has a viewer (whose translation / access levels will be used to generate the mail).
  • Each target has a to/cc list (the users who we'll ultimately send the mail to).
• For each target, build a custom mail body based on the viewer's access levels and settings (language prefs not actually implemented).
• Then, deliver the mail.

Test Plan:

• Read new config help.

Then did a bunch of testing, primarily with bin/mail list-outbound and bin/mail show-outbound (to review generated mail), bin/phd debug taskmaster (to run daemons freely) and bin/worker execute --id <id> (to repeatedly test a specific piece of code after identifying an issue).

With one-mail-per-recipient on (default):

• Sent mail to multiple users.
• Verified mail showed up in mail list-outbound.
• Examined mail with mail show-outbound.
• Added a project that a subscriber could not see.
  • Verified it was not present in X-Phabricator-Projects.
  • Verified it was rendered as "Restricted Project" for the non-permissioned viewer.
• Added a subscriber, then changed the object policy so they could not see it and sent mail.
  • Verified I received mail but the other user did not.
• Enabled public replies and verified mail generated with public addresses.
• Disabld public replies and verified mail generated with private addresses.

With one-mail-per-recipient off:

• Verified that one mail is sent to all recipients.
• Verified users who can not see the object are still filtered.
• Verified that partially-visible projects are completely visible in the mail (this violates policies, as documented, as the best available compromise).
• Enabled public replies and verified the mail generated with "Reply To".

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: carlsverre, epriestley

Maniphest Tasks: T6367

Differential Revision: https://secure.phabricator.com/D13131