Caused by setting old zone nodes' NSEC3 references to new NSEC3
nodes. Probably useless anyway, just disabled it.

refs #4, #103

Compare RDATA count in each RR set at first, therefore it is
sufficient to check just from r1 to r2.

There was a bug which caused the function to return true if
the RDATA were not equal, but only the last entry matched.

- changes are written into journal
- from some reason the zone struct is not set correctly

Update changeset by filling old SOA and new SOA with incremented serial.

- needed for zone diff and DNSSEC
- knot_rrset_deep_free_no_sig() already exists

- the result is written as a set of operations into a changeset
  instead of creating a whole new zone tree
- works only for NSEC3 at the moment

- will be used for journal entries created by DNSSEC signing

- slightly modifies interface for zone contents diffing
  (shorter name, add changesets flags parameter)
- new function works the same with other arguments

- split the functions to smaller chunks
- delegate repeated code
- work with zone tree instead of zone content

libknot/dnssec now contains interface for:
- key loading
- low level DNSSEC signing
- NSEC3 hash computation
- SIG(0)
- generating NSEC/NSEC3 records for zones
- generating RRSIG for zones

- KNOT_NODE_FLAGS_OLD and KNOT_NODE_FLAGS_NEW is not used
- KNOT_NODE_FLAGS_EMPTY is used only in dname.c now, but is already
  removed in dname refactoring branch

(knot_zone_t -> knot_zone_contents_t)

- no functional changes
- outdated descriptions were removed/updated
- reduced number of necessary iterations over the zone nodes