DS support in DNSSEC

See merge request !409

fix IP_FREEBIND with IPv6

See merge request !405

Socket level for IP_FREEBIND is IPPROTO_IP (not IPPROTO_IPV6) for IPv6.

close #393

No CNAME following for NSEC query

See merge request !397

close #389

minimal responses

See merge request !396

The option 'additional-from-auth' controls additionals lookup from the
other zones the server is authoritative for. It makes no sense as the
resolvers will drop out-of-bailiwick records.

The option 'additional-from-cache' should make no sense if recursor
functionality is disabled. This is just to be sure.

The Additional section of the answers should be compared with BIND on
expected delegations.

Knot DNS also puts A/AAAA records into the Additional section for NS,
MX, and SRV records.