Speed: on my office desktop it didn't increase the amount of resources
needed to run all the tests; I actually got a little shorter time,
but that was most likely due to random variations.

NSEC proofs refactoring

Close #191, #471

See merge request !570

NSECs don't exist at non-terminals, NSEC3s don't exist in opt-out.

The real previous name has to be stored because the wildcard
needn't be expanded from QNAME but can be expanded as a part
of CNAME/DNAME chain.

Don't require the node to be authoritative. This is need for DNSSEC
proofs and this should be handled there.

DNS over TLS in kdig



See merge request !569

Trie index: minor improvements

Main point: don't segfault when trying to use an ordered index that wasn't built, and instead rebuild it for that particular node whenever needed. More details in commit messages.

Note: over longer term I expect a different solution for tries, at which point this simple MR would become irrelevant.

See merge request !566

Fixes #466 by adding a "strict" flag to the apply context structure. The "strict" flag is also applied with DNSSEC signing (event handler and when zone-loading) but it is not applied when loading and applying changesets from journal and within zone_update (which takes care of DDNS and jetconf so far).

See merge request !567

When an index is required, rebuild it instead of using the NULL pointer.
This allows lazy approach, as index rebuilding is relatively expensive
and it might not be clear if it's needed before another change happens.
The price of the added unlikely(==NULL) checks is *very* low.

- ensure invalidation even when malloc fails (in hhash_map)
- check it is invalidated whenever the key set changes
- don't rebuild a valid index, so hhash_build_index() is cheap if valid