* PIE,RELRO+NOW and other security features enabled
* support for both static/dynamic builds with BUILDMODE
* dynamic library is ABI-versioned, starting at 1
* pkg-config file is installed

this is needed to make sure it always compiles with PIC

this allows to override any dstdir variable without
patching config.mk

if the root key file doesn’t exist, it will be populated from root DNSKEY query, which will be validated against root trust anchors retrieved over HTTPS with IANA cert verification against built-in current IANA cert CA. it requires luasocket and luasec for it to work. trust anchors XML file signature is not checked, as there’s no facility for PKCS7 checking yet.

validator can now yield, but it doesn't plan the sub-requests directly,
that is still a job of the driver

same for LDFLAGS. this fixes common problem where CFLAGS after make
was evaluated as a make variable and replaced the default, while
before as env variable and was prepended to the default string.
now they both behave as an env. variable

also some cleanup and version bump to Q2

previously cryptolib random function was used to generate message id,
this works well but it is slow especially when the entropy is low,
replaced with cryptographically safe prng ISAAC

the ccan directory is going to be used in the future, as it's include
structure makes it easy to embed C snippets instead of reimplementing
them

interface split to ‘map’ and ‘set’
added documentation
array: added array_tail() operation

the build system now doesn't always relink targets