Ignore msg security for Challenge API messages

modules/challenge/src/main/ChallengeMsg.scala

@@ -28,7 +28,7 @@ final class ChallengeMsg(msgApi: lila.msg.MsgApi, lightUserApi: LightUserApi)(im
           .replace("{player}", s"@${u1.name}")
           .replace("{opponent}", s"@${u2.name}")
           .replace("{game}", s"#${gameId}")
-        msgApi.post(managedById, u1.id, msg, multi = true)
+        msgApi.post(managedById, u1.id, msg, multi = true, ignoreSecurity = true)
       }
       .sequenceFu
       .void

modules/msg/src/main/MsgApi.scala

@@ -78,14 +78,17 @@ final class MsgApi(
       orig: User.ID,
       dest: User.ID,
       text: String,
-      multi: Boolean = false
+      multi: Boolean = false,
+      ignoreSecurity: Boolean = false
   ): Fu[PostResult] =
     Msg.make(text, orig).fold[Fu[PostResult]](fuccess(PostResult.Invalid)) { msgPre =>
       val threadId = MsgThread.id(orig, dest)
       for {
         contacts <- userRepo.contacts(orig, dest) orFail s"Missing convo contact user $orig->$dest"
         isNew    <- !colls.thread.exists($id(threadId))
-        verdict  <- security.can.post(contacts, msgPre.text, isNew, unlimited = multi)
+        verdict <-
+          if (ignoreSecurity) fuccess(MsgSecurity.Ok)
+          else security.can.post(contacts, msgPre.text, isNew, unlimited = multi)
         _ = lila.mon.msg.post(verdict.toString, isNew = isNew, multi = multi).increment()
         res <- verdict match {
           case MsgSecurity.Limit     => fuccess(PostResult.Limited)