Upgrade accounts saved as http:// to https on launch

Before the previous commit, browser sign-in could store an account as
http://, and the client now refuses to send to one. Left alone, such a
library would fail to open with a configuration error, so its stored
endpoint is rewritten before anything reads it.

The endpoint is half of two keys, and both are handled:

- The keyring entry is filed under it. Rewriting only the record would
  strand the app password under the old key and sign the user out, so
  AccountStore::move_endpoint copies the secret across first, rewrites
  the record in place (the last record is the one resumed), and deletes
  the old entry only once nothing refers to it.
- namespace() is built from it and names the catalog directory. For an
  http to https rewrite it does not change, because the namespace strips
  either scheme. A move that would change it is refused, not performed,
  so no later rewrite can abandon a catalog either.

The rewrite is a new BackendProvider::upgrade_endpoint hook, which does
nothing by default, and not a second call to normalise_endpoint. The
folder connector's normalise_endpoint canonicalises the path and needs
it to exist, so running it on every launch would fail a library on an
unplugged disk, or rename one whose path now resolves differently. Only
Nextcloud implements the hook.

If the move fails (for example, a locked keyring), it is logged, the
account is left as it was, and the move is tried again on the next
launch.

Closes #65.

core/dr-sync/src/provider.rs

@@ -83,6 +83,20 @@ pub trait BackendProvider: Send + Sync {
     /// wrong rather than naming a type.
     fn normalise_endpoint(&self, input: &str) -> Result<String, String>;
 
+    /// The form a *stored* endpoint should take now, where an older build
+    /// wrote one this build would not.
+    ///
+    /// Not [`normalise_endpoint`](Self::normalise_endpoint) run again: that
+    /// judges what a person typed, and may touch the world to do it — a folder
+    /// is canonicalised and must exist — so rerunning it on every launch would
+    /// fail a library whose disk is unplugged, or rename one whose path now
+    /// resolves differently. This is a pure rewrite of the string, and `None`
+    /// means leave it alone, which is the answer for almost every connector.
+    fn upgrade_endpoint(&self, stored: &str) -> Option<String> {
+        let _ = stored;
+        None
+    }
+
     /// Build an account from a normalised endpoint alone.
     ///
     /// Only meaningful for [`SignIn::EndpointOnly`]; a browser flow produces