Related to PR #6405

Note that this breaks API compatibility with Redis < 6:

    CONFIG GET requirepass

Will no longer return a cleartext password as well, but the SHA256 hash
of the password set.

This commit fixes bug reported at #5998. Thanks to @tomcat1102.

Adding another new filed categories at the end of
command reply, it's easy to read and distinguish
flags and categories, also compatible with old format.

Otherwise it's very simple for an human mistake to think a password is
removed because of a typo in the ACL SETUSER myuser <somepass command
line.

Soon or later we may have code in freeClient() that may have to deal
with ACLs. Imagine for instance the command proposed multiple times (not
sure if this will ever be accepted but still...):

    ONCLOSE DEL mykey

Accumulating commands to run when a client is disconnected. Now the
function is compatible with such use cases.

Related to #5829.

We can't trust modules commands flagging, so module commands must be
always explicitly added, with the exception of +@all that will include
everything. However something like +@readonly should not include command
from modules that may be potentially dangerous: our categories must be
safe and reliable and modules may not be like that.