i.e. if the user doesn't set the cache, it will be applied later
if he sets it, it will stay

this is going to be needed for issuing multiple timed queries + fast
retry

effectively enables/disables usage of given IP protocol
for subrequests (the server can still listen on these)

if the answer is flagged as insecure, it means that the resolver tried
to validate it, but couldn't (e.g. trust chain doesn't exist)

- can query cache for records
- can remove only domain or subtree from cache
- can remove data in packet cache or other prefixes
- cache clear also reset NS reputation tracking

the key is now stored in a format friendly to prefix search, the values
also contain one more 16bit field to store rank of the data (to be
utilised later)

this is a problem when both CNAME and the target are answered from the same NS (but different authority), but only the CNAME authority does DNSSEC. it’s probably legal, but it’s pretty stupid to do so

same for LDFLAGS. this fixes common problem where CFLAGS after make
was evaluated as a make variable and replaced the default, while
before as env variable and was prepended to the default string.
now they both behave as an env. variable

before the algorithm was happy with root hints for all queries starting
at root, however they're often overloaded and result in timeouts
the updated code provides SBELT only for root NS query lookup and tries
to use cached information as much as possible