Remove trailing NUL byte from AUTH LOGIN challenges (Fixes #566)

[apoorvdarshan]

What do these changes do?

The AUTH LOGIN username and password challenge constants in SMTP carried a trailing NUL byte:

AuthLoginUsernameChallenge = "User Name\x00"
AuthLoginPasswordChallenge = "Password\x00"

Base64-encoded and sent as the 334 challenge, these produce VXNlciBOYW1lAA== / UGFzc3dvcmQA, whose decoded value contains an embedded \x00 (User Name\x00 / Password\x00).

Strict SMTP clients do an exact string compare on the decoded challenge and abort AUTH when it contains the NUL byte. This breaks:

• Go net/smtp (used by Prometheus Alertmanager v0.27+), which errors with unexpected server challenge
• curl

Observed on the wire:

<< challenge: b'334 VXNlciBOYW1lAA=='
client aborted AUTH with '*'
<< b'501 5.7.0 Auth aborted'

Fix

Remove the trailing \x00 from both class constants so the challenges decode to User Name / Password:

AuthLoginUsernameChallenge = "User Name"
AuthLoginPasswordChallenge = "Password"

The challenge_auth() call sites need no change. The base64 challenge values in the SMTP_STATUS_CODES test-support module (S334_AUTH_USERNAME, S334_AUTH_PASSWORD) are updated to match the new, NUL-free encoding.

This is the minimal correctness fix for the null-byte problem reported in the issue. Changing the challenge text to Username: / Password: (the issue's second, optional suggestion) is intentionally left out, as that is a separate behavioral/design decision.

Are there changes in behavior for the user?

The 334 AUTH LOGIN challenges no longer contain a trailing NUL byte, so strict clients (Go net/smtp, curl) can complete AUTH LOGIN. The plaintext prompts remain User Name / Password.

Related issue number

Fixes #566

Tests

• Added test_login_challenges_have_no_nul_byte, which performs an AUTH LOGIN exchange and asserts the base64-decoded username and password challenges contain no \x00. It fails on the pristine code (assert b'\x00' not in b'User Name\x00') and passes with the fix.
• Existing AUTH/LOGIN tests updated via the shared status constants; full test suite passes locally (555 passed, 3 pre-existing skips).
• A NEWS.rst entry was added under 1.4.7 (aiosmtpd-next).

Disclosure: prepared with AI assistance; reviewed and verified locally.