Drop "@" from email sender to avoid spam filters

[gwymor]

Commit 360b3fd (Include username in email headers (#28981),
2024-02-03) adds usernames to the From field of notification emails in
the form of Display Name (@username), to prevent spoofing. However,
some email filtering software flags "@" in the display name part of the
From field as potential spoofing, as you could set the display name part
to another email address than the one you are sending from (e.g.
From: "apparent@email-address" <actual@email-address>). To avoid
being flagged, instead send emails from Display Name (username).

Closes: #29107

[gwymor]

Reposting my comment from the original PR:

When a user has no display name the sender currently falls back to @username. If we change that to just username, I'm afraid that doesn't make it clear enough that this is a username that cannot be spoofed (aside from inspecting the X-Gitea/GitHub-Sender headers, which I think is too much to require a user to do in a spoofing attempt) -- you can't easily tell the difference between a post-1.22 Gitea sending a username, and a pre-1.22 Gitea sending a displayname that looks like a username. We could remove the fallback code, and always show Display Name (username), which will fall back to username (username). That would be more consistent and easy to verify at a glance, but perhaps noisy.

This PR currently just removes the @, which means when no display name is set, the sender will be username. I'm still undecided, so please give input on this part and I can update the PR accordingly.

[GiteaBot]

I was unable to create a backport for 1.21. @gwymor, please send one manually. 🍵

go run ./contrib/backport 29109
...  // fix git conflicts if any
go run ./contrib/backport --continue

[gwymor]

@silverwind The original code that this adjusts ( #28981) was never backported. Did you want both backported?

[silverwind]

No, then the backport is unnecessary.