Add separate validation level for cellphone validation

[wens]

The plan is to do account validation with cell phone verification via SMS or AOTP solutions.
The solutions will almost all be using HTTP. Cell phone verification should be a separate level.

First, we need data fields to store the data. I suggest using the _unused1 field in struct userec_t for extra permissions. We might want to combine it with the existing userlevel into a 64bit unsigned value. For the phone number, the old _unused_phone field is still there.

Second, we'll need to duplicate the existing email validation system, but with separate storage for in-flight validation codes, as well as the central database used to check for duplicates.

Third, integration with service provider. Probably use libcurl, either in-process, or queued request in a separate daemon.

More to come later....

[chhsiao1981]

2e1c6c6

(Is this issue already done?)