Speed: on my office desktop it didn't increase the amount of resources
needed to run all the tests; I actually got a little shorter time,
but that was most likely due to random variations.

NSEC proofs refactoring

Close #191, #471

See merge request !570

NSECs don't exist at non-terminals, NSEC3s don't exist in opt-out.

The real previous name has to be stored because the wildcard
needn't be expanded from QNAME but can be expanded as a part
of CNAME/DNAME chain.

Don't require the node to be authoritative. This is need for DNSSEC
proofs and this should be handled there.

DNS over TLS in kdig



See merge request !569

Trie index: minor improvements

Main point: don't segfault when trying to use an ordered index that wasn't built, and instead rebuild it for that particular node whenever needed. More details in commit messages.

Note: over longer term I expect a different solution for tries, at which point this simple MR would become irrelevant.

See merge request !566

Fixes #466 by adding a "strict" flag to the apply context structure. The "strict" flag is also applied with DNSSEC signing (event handler and when zone-loading) but it is not applied when loading and applying changesets from journal and within zone_update (which takes care of DDNS and jetconf so far).

See merge request !567