in permissive mode, resolver is free to use
(but not cache) non-mandatory glue records even
if they're not resolvable. this is great as a 
workaround for broken child-side zones, but
not great for security of, well, insecure
delegations. it's off by default.

Merge branch 'PaulosV-patch-1-readme-docker' of https://github.com/PaulosV/knot-resolver into PaulosV-PaulosV-patch-1-readme-docker

Merge branch 'daemon-doc-typo' of https://github.com/thozza/knot-resolver into thozza-daemon-doc-typo

new trust anchors variables:
* trust_anchors.hold_down_time = 30 * day
* trust_anchors.refresh_time = nil
* trust_anchors.keep_removed = 0

these could be used to control how often should
root trust anchors be checked and how many removed
keys should be kept in log (0 by default)

Signed-off-by: Tomas Hozza <thozza@redhat.com>

addition to previous generic socket activation

fixes #11

daemon can accept existing fds on command line,
thus supporting process managers like circus or
upstart. a tiny supervisor script is attached

previously full timeout led to reset of the evaluated
address list and no upstream server was penalised
for not answering the query, this penalises all of
tried servers with TIMEOUT

Fixed nsec3 proof validation with opt-out below wildcard



See merge request !17

graphite module now supports sending over TCP,
if the connection is severed it will attempt to
reconnect periodically. the stats module is now
optional, if not loaded only core built-in stats
will be transmitted