fix(mail): vendor AWL — Z-Push's CalDAV client requires it at login

include/z_caldav.php needs XMLDocument.php from AWL (Andrew's Web
Libraries); the Debian z-push packages pull php-awl in automatically
but bookworm dropped the package, so vendor it from upstream at
r0.65 into /usr/share/awl/inc (already on Z-Push's include_path).
Only surfaces on *authenticated* requests: combined login hits IMAP
first, so fake-credential smoke tests never reach the CalDAV class.

Hardening from the same incident: a build-time class-load smoke test
fails the image if any backend dependency is missing, and
zend.exception_ignore_args stops uncaught fatals from logging the
raw passwords Z-Push passes through Logon().

services/zpush/php/zpush.ini

@@ -9,3 +9,6 @@ log_errors = On
 error_log = /dev/stderr
 display_errors = Off
 expose_php = Off
+; Never capture function arguments in exception traces — Z-Push passes raw
+; passwords through Logon(), and an uncaught fatal would log them.
+zend.exception_ignore_args = 1