Merge branch 'PaulosV-patch-1-readme-docker' of https://github.com/PaulosV/knot-resolver into PaulosV-PaulosV-patch-1-readme-docker

Merge branch 'daemon-doc-typo' of https://github.com/thozza/knot-resolver into thozza-daemon-doc-typo

new trust anchors variables:
* trust_anchors.hold_down_time = 30 * day
* trust_anchors.refresh_time = nil
* trust_anchors.keep_removed = 0

these could be used to control how often should
root trust anchors be checked and how many removed
keys should be kept in log (0 by default)

Signed-off-by: Tomas Hozza <thozza@redhat.com>

addition to previous generic socket activation

fixes #11

daemon can accept existing fds on command line,
thus supporting process managers like circus or
upstart. a tiny supervisor script is attached

previously full timeout led to reset of the evaluated
address list and no upstream server was penalised
for not answering the query, this penalises all of
tried servers with TIMEOUT

Fixed nsec3 proof validation with opt-out below wildcard



See merge request !17

graphite module now supports sending over TCP,
if the connection is severed it will attempt to
reconnect periodically. the stats module is now
optional, if not loaded only core built-in stats
will be transmitted

the validator module should ignore any data that
will be scrubbed, that includes non-authoritative
data outside current bailiwick. previously, 
validator attempted to ignore these records only
for answer section and had a special case for NS
records.

cache: non-authoritative NS records are always
unchecked and must be treated as insecure

affected: www.iana.org trying to provide
delegation information for CNAME target, which is
moot with CNAME target explicit-fetch policy unless
the the resolver already knows DNSKEY with which
is could verify the records

kresd accepts DS records in root keys if provided,
it will eventually replace them with DNSKEY in
automatic mode