dnssec: bugfix: key rollovers timing according to real TTLs

See merge request !1146

It's necessary to save the DNSKEY TTL and zone maximal TTL
at the time of previous rollover step, so that the next
step corresponds with TTLs in resolvers' caches.

conf: allow configuring acl with a remote

Closes #669

See merge request !1144

onlinesign: bugfix: dont promote NXDOMAIN to NOERROR if not signed

See merge request !1145

Tests extra updates

See merge request !1141

rename xdp-gun to knot-xdp-gun

See merge request !1143

Xdp gun opts

See merge request !1133

Also, fix an unrelated comment.

By allowing the test to send more requests under Valgrind, there is a better
statistical chance for obtaining more accurate test results and avoiding false
test failure (it should prevent false RRL ERRORs).

Under Valgrind, it is also safer to provide the server more time to respond
(it should prevent false RRL STATS ERRORs).

zone_backup() can be done synchronously as a result of a recent update to the flush() function
(flush() in zone_backup() is always called in blocking/synchronous mode).

The blocking option ("wait") of ctl() could be used instead of the first wait_for_dnskey_count() call.
Not using it, keeping the original test style.

Also, convert both Bind and Knot flush()'s to use this new functionality.

Complete apex NS RRSet removals (ANY NS removals) aren't processed by the server
(see RFC 2136, Section 7.13). If such a removal (or removals) is the only change
in the update, then it's a no-change DDNS update to the zone, which usually breaks
the test. Therefore, generate such removals, but don't count them as changes.

test dnssec/key-rollovers: check for minimal delay between roll steps

See merge request !1142

... not breaking it on slow CPU's (or with Valgrind) at the same time.

Parallel adjust

See merge request !1126