shun: defer add-time ident match when client's USER hasn't landed

[MrLenin]

Summary

Fixes a long-standing false-positive in do_shun (the retroactive
shun-apply loop run at SHUN add time) where the ident half of a
user@host mask was bypassed for any client mid-registration.

A guard at ircd/shun.c:221-223 (introduced in 2019 by f317973)
short-circuited the whole ident match on empty cli_user->username,
which is the case for every client between make_user() (allocates
cli_user on first input) and register_user() (populates
username from the USER command). Result: a shun like bob@* would
match every mid-registration client, and the server emitted a
spurious SNO_GLINE "Shun active for " oper notice
attributing the shun to a user whose ident doesn't (yet) match.

The fix inverts the guard: always defer pre-USER, except when
sh_user is the literal single bare * (the only shape we can prove
matches any ident). The explicit sh_user[1] == '\0' check is
needed so non-bare patterns that lead with * (e.g. *foo = "ends
with foo") don't sneak through the shortcut.

Behaviour preserved

• *@host shuns still apply pre-USER (the original "no identd
  running" use case — Jobe's intent in the 2019 guard).

Behaviour fixed

• bob@*, *foo@*, ?bob@*, ?*@*, and every other pattern with a
  specific ident half no longer false-positive against
  mid-registration clients.

No enforcement consequence

shun_lookup invoked from m_privmsg/etc. re-evaluates the shun
once the client's USER lands and its ident match runs unconditionally
there. This patch only fixes the add-time apply loop's mirror
behaviour — what it suppresses is the spurious oper-side notice for
the wrong user.

Test plan

Verified against an integration testnet (MrLenin/testnet) with
5 vitest cases covering:

• Pre-USER client + bob@* mask → no false-positive (the bug)
• Registered + non-matching ident → no false-positive (regression)
• Registered + matching ident → matches (sanity)
• Pre-USER + *foo@* mask → deferred (*foo is "ends with foo", not match-any)
• Pre-USER + ?bob@* mask → deferred (?bob is "char-then-bob", not match-any)

All 5 pass against the patched build.