open https://gitlab.synchro.net/main/sbbs/-/work_items/1298

`exec/irc.js` sends the user's BBS password as `PASS` to whatever IRC server it connects to:

```js
var user_password = user.security.password;
...
if(user_password)
send_cmd("PASS", user_password);
```

It has done this since well before b45c2678a3 (moisture-58-lies, 2024-07-16), which only added the `-p` option to override the value; the original line was commented `// for use with JS IRC server`. The connection is cleartext (`irc.js` has no TLS support yet, #1213).

## Why it matters

- **The password goes to servers the sysop doesn't run.** The stock default server is `irc.synchro.net`, a round-robin across Synchronet IRC network servers run by different sysops. On Vertrauen, about 4 connections in 5 landed on someone else's ircd, carrying the user's BBS password. Any sysop who points `irc.js` at a third-party network (`chat_sec.js` lets level 90+ users type any server) does the same.
- **It is readable on the wire** by anything between the BBS and the IRC server.
- **The receiving ircd may now check it.** IRCd 2.6+ authenticates every `PASS` against the BBS user database (separate issue), so the password is no longer just ignored by the server.

## Suggested fix

Send `PASS` only to servers the sysop trusts with BBS passwords, e.g. only when the IP address actually connected to (`sock.remote_ip_address`, not the server name, because round-robin names resolve to many hosts) is in a configured list. The new `[irc]` `webirc_servers` option in `ctrl/modopts.ini` is such a list and could be reused, or a separate `pass_servers` list added. With no list configured, send no `PASS` (the `-p` option still allows an explicit value).

-- *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.38-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)