Do not auto-auth bare domains
Bare-domain JIDs match the "transport" condition, and were getting auto-authorized. Not only is this a privacy problem (anyone with a bare-domain JID can get your presence) but it's also a usability problem (since the GUI does not allow initiating a subscription request the other direction).
If a UI flow wants a JID auto-authed it can add that JID to self.jids_for_auto_auth and this code will still fire.
Closes #8597 (closed)