bug#28597: 26.0.60; [Security] Configure should use --without-pop by default

[Eli Zaretskii <eliz@gnu.org>]

> From: nljlistbox2@gmail.com (N. Jackson)
> Cc: jwiegley@gmail.com,  eggert@cs.ucla.edu,  28597@debbugs.gnu.org
> Date: Fri, 29 Sep 2017 14:14:29 -0400
> 
> > That default is activated only if you do [have Mailutils].
> 
> I see.
> 
> I don't think that makes sense, does it?

I hope it does, as this is what I asked for at the time, for reasons
that did make sense to me.

> There's nothing terribly odd about my system and if the warning
> message from config is true, then _by default_ I'm going to get
> built an insecure Emacs.

Only if you use POP3 to fetch your mail.  Which I presume you don't;
if you did; building --without-pop by default would have left you with
no way of getting your email into Emacs.

> I think that --without-pop should be the default. Unconditionally.

We should think about all of our users when we make such decisions.  I
myself don't use unencrypted POP3 either, but I'm worried about the
effect this change could have on someone who does.