Reserve privileged alias addresses for admins

Any user could create aliases like postmaster@, webmaster@ or abuse@ on
their domain. CAs use these addresses to validate domains, so a family
account (or a compromised one) could obtain TLS certificates or catch
abuse and system mails.

- Only admins may create aliases with a reserved local part (admin,
  administrator, webmaster, hostmaster, postmaster, abuse, security,
  noc, root, mailer-daemon). The acting user counts, so admins can
  still assign such aliases to other users.
- Escape the domains in the email regex, so "finn.st" no longer
  matches "finnXst".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

max/routes/alias/create.py

@@ -42,6 +42,12 @@ class AliasCreate(
         full_email = f"{self.email}@{self.domain}"
         if not self.is_email_valid(full_email):
             error = True
+        elif not self.auth_user.is_admin and self.is_reserved_email(full_email):
+            flash(
+                t("This address is reserved and can only be created by an admin."),
+                category="error",
+            )
+            error = True
 
         enabled = self.request.form.get("enabled")
         if enabled == "on":