Some RCODEs other than NOERROR may result in DNSSEC processing,
e.g. NXDOMAIN.

Not supported in trie because of the API incompatibility.

- Serials are checked during SOA response processing. Incoming
  AXFR should be accepted even if the serial is older. (In order
  to allow forced refersh.)

Extended RCODE is one 12-bit number. Until now it was not only
handled separately for old and new RCODEs, but it was also
interpreted wrong.

Unified RCODE processing - it's represented by only one number and
writing into the packet takes place at the end of query processing.

refs #300