mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection

Jan Kundrát reports:

An SSL stripping vulnerability was discovered in Trojitá, a fast Qt
IMAP e-mail client. User’s credentials are never leaked, but if a
user tries to send an e-mail, the automatic saving into the “sent”
or “draft” folders could happen over a plaintext connection even if
the user’s preferences specify STARTTLS as a requirement.