A bounce in one organization suppresses the recipient for every organization #320

A bounce in one organization suppresses the recipient for every organization. One tenant can block a shared recipient address for all tenants for 30 days.

SuppressionQuerySet.is_suppressed treats a bounce entry from any organization as suppressing for 30 days, regardless of which organization is sending:

models.Q(org=org)
| models.Q(reason=self.model.Reason.BOUNCE, created_at__gte=bounce_cutoff)

A single permanent 5xx for a shared recipient address therefore blocks that address relay-wide for every other tenant. Examples of such a 5xx are a policy refusal, a spam block, or a full mailbox at the receiving host. The block also hits tenants that have a healthy relationship with the recipient. The suppression entry carries no indication of which tenant produced it. There is no owner-visible reason beyond the word "bounce".

Evidence:

• services/email/msa/models.py: SuppressionQuerySet.is_suppressed
• services/email/msa/tasks.py: record_bounce, the only writer of bounce entries

Decisions to make:

• Must a cross-organization bounce suppress at all?
• Must it expire faster than an organization's own bounce?
• How does an organization learn that a recipient it never mailed is suppressed for it?

Found during the sandbox-credentials change (#259). This fault is older than that change.