DKIM: adjust default signed headers to allow forwarding

[pacien]

Sign Sender, Resent-* and List-* headers only when present.

Those headers are commonly added or altered when messages are forwarded
manually or through mailing lists. The inclusion of their absence in the
signature causes those messages to be rejected or marked as spam by
the final recipient servers.

Additional explanations from some ML:

Your email gets marked as spam when it goes through a mailing list,
because the DKIM setup is wrong, and your DKIM header lines look like
this:

  DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=[…];
         s=[…]; h=Date:Message-ID:Cc:In-Reply-To:Subject:From:
        Content-Transfer-Encoding:MIME-Version:Content-Type:Reply-To:To:Content-ID:
        Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
        :Resent-Message-ID:References:List-Id:List-Help:List-Unsubscribe:
        List-Subscribe:List-Post:List-Owner:List-Archive;
        ...

and that's completely wrong when sending to a mailing list that will
explicitly add things like

  Sender: [email protected]
  Precedence: bulk
  List-ID: 
  X-Mailing-List: [email protected]

to help people see that it got expanded by a list. But because your
DKIM signature mentions fields like "List-ID", the resulting hash will
obviously not match any more after having gone through the list.

[…]

Anyway, a proper DKIM setup should have core headers like
from/to/subject/in-reply-to/message-id etc in the list of protected
headers. But it should _not_ try to protect things like List-ID or
List-Archive, which are very much about mailing lists you might be
sending things to.

It also shouldn't protect things like "Sender", which again are things
like list email re-sending, not in the original email. […]
that's another common configuration mistake that
makes DKIM useless with mailing lists.

            Linus "spam is my nemesis, trying to fix things" Torvalds