Conflicts:
	src/libknot/tsig-op.c

Forwarding Fix

Correct message id reinstating, appending of TSIG RR when forwarding query/response.

Zone Loading Failed Diff + test cases

See the commit messages, should be clear.
Also, the `failed to sign the zone:` message appears also when ixfr-from-differences fails, because it's together in one function (so it prints out even if I don't have DNSSEC signing enabled).
I'm not sure how to handle this properly, maybe have differences and zone signing in a separate functions and print the reason from within.

covered:
- data change, serial increase
- data change, serial doesn't change
- data change, serial < initial serial

zone

fails

Conflicts:
	src/knot/dnssec/nsec-chain.c
	src/knot/dnssec/nsec3-chain.c
	src/knot/nameserver/name-server.c
	src/knot/nameserver/nsec_proofs.c
	src/knot/updates/ddns.c
	src/knot/updates/xfr-in.c
	src/knot/zone/node.c
	src/knot/zone/zone-diff.c
	src/knot/zone/zone-dump.c
	src/knot/zone/zone-load.c
	src/knot/zone/zone-load.h

- New removal of obsolete RRSIGs
- Adding RRSIGs with RRSet to changeset
- Signature shallow copy rewritten
- Bad assumptions about RRSet count in node rewritten

- Not complete: Empty non-terminal's RRSIGs are deleted, but NSEC3 are created. (already fixed in 'master' branch, will fix during merge)
- Fails nsec->nsec3 transition test