zonecut should be able to hold these for testing reasons (like private
root or zone cut), but it should filter out data from the internet
a new flag: QUERY_ALLOW_LOCAL allows for being more permissive, and
letting name server query local or private address ranges

this needs more work to find the correct libfaketime library
(newer version is required for FAKETIME_TIMESTAMP_FILE)
we may bundle it as it's small

the query flags were cleared too early, and the rec never
retried if the NS had ipv6 addresses, but all were bad

this fixes an issue when nameserver responds with AA=0 and authority
of a CNAME target (which is in current bailiwick)

before root hints were hardcoded to the resolver,
now they are present in form of a cut in the resolution
context, and the modules can add/remove/replace them
on the fly

fixes potential cache key oob write

this relies on a lot of things (intrinsic), frame pointer and symbol dynamic symbol table

also some cleanup and version bump to Q2

previously if NS had no A/AAAA records, they we’re looked up in subrequests, after that a new NS was reelected (possibly preferring another unknown), now it stays true to the NS of choice and changes only if it is unuseable

the cache_peek() api was reworked to return an error code instead, from this the caller can tell whether the record is present (but expired) or missing. this save a secondary CNAME lookup in case the original record was just expired

this LRU-like cache tracks lame nameservers, unresolvable
nameservers (to not waste resources in trying to resolve them),
and possibly other features (extension support, …)

The parsing of *.rpl files failed on reading DS records because the
algorithm identifier is a string rather than a number.