any answer that is considered as malformed/servfail/otherwise bad
penalizes the NS for the next time like timeout, this doesn't apply for
DNSSEC validation failures as it still may be okay for insecure
resolution. EDNS failures are okay because the server is requeried in
the most simple RFC1035 mode before flagging it as failed

this avoids instant requeries for SERVFAILing resolutions

when a delegation is provably insecure, it is flagged as INSECURE in
cache (this is different from "unchecked"), when the next query finds
the same zone cut, this information is retrieved and if it was proved to
be insecure before, this status is reused

this prevents refetching of NS/DNSKEY in some situations

daemon/io: remove redundant libknot/internal/utils.h include



See merge request !16

notably key id doesn’t have to be recalculated every time, cheaper checks should come first, name equality check is cheaper as well 

skipping over last/root label returns a pointer to a memory after domain name, this is unsafe

this doesn’t guarantee valid cache after crash,
but then it’s a cache. most of the time on cold
cache is spent on fsyncing as it’s done per each
commit (=> resolved query)

this also fails if the timeout timer cannot be started,
as it would wait for undefined time otherwise

amalgamated build concatenates all files into a single .c file to
allow compiler see all symbols and produce possibly smaller code.
for binary distributions this is what you want, as it's faster but
may consume more memory during compilation.
it however cannot do incremental builds.