Closes: #1016351

- CVE-2021-29157: Path traversal issue allowing an attacker with
  access to the local filesystem can trick OAuth2 authentication into
  using an HS256 validation key from an attacker-controlled location
- CVE-2021-33515: Sensitive information could be redirected to an
  attacker-controlled address because of a STARTTLS command injection

The test suite does not pass reprotest:

test-buffer-istream.c:54: Assert failed: buffer_append_full_file(result, TEST_FILENAME, SIZE_MAX, &error) == BUFFER_APPEND_READ_ERROR
test-buffer-istream.c:56: Assert failed: error != NULL && *error != '\0'
buffer_append_full_file .............................................. : FAILED

But generally dovecot builds reproducible, see
https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/dovecot.html

Update to upstream version '2.3.13+dfsg1'
with Debian dir b5b702426c1d3b2c5af09d6657286d90b498e0b7

Add libzstd-dev to build-dependencies (Closes: #969165)

See merge request debian/dovecot!17

Enable zstd in zlib_plugin

debian/dovecot!16

debian/dovecot!15

The feature has been removed from the autopkgtest configuration.