Two main use cases are actual RPZ file
and also the /local-data/records string (plain RRsets).

The RPZ semantics isn't very close to the specs,
but I believe the practical usability is already better
than our old RPZ implementation, thanks to following CNAMEs.

(internally at least, not in api.h yet)

They're a bit weird but RPZ has something close to them.

It's questionable which SOA owner to use, but some users will surely
prefer NXDOMAINs to empty zones.

Example:
  assert(require('ffi').C.kr_view_insert_action(
  		'127.0.0.0/24', 'policy.DENY_MSG("message")'
	) == 0)

Also switch the localhost rule there, finishing migration
of all special names from the policy module.

fixes modules/dns64 test

Picked up old work, rebase-squashed after many months;
then fixed up a little as needed in this newer version.
(and later many minor fixes got squashed in)