previously it was always overwritten with SBELT for root + root TA
doesn't have to be in cache (it's in trust store)

refs #33

This reverts commit 0f9e615b.

the selected address is now an array with selection, caller can then send the same query to multiple offered targets

refs #35

this could happen if the query contained a CNAME with AA=0, or missing mandatory DS in previous NS query

example:
local rr = pkt:section(kres.section.ANSWER)[1]
print(kres.rr2str(rr))

example:
local rr = pkt:section(kres.section.ANSWER)
for i = 1, #rr do
	if rr[i].type == kres.type.A then
		print(kres.dname2str(rr[i].owner))
		print(‘rdlen:’, #rr[i].rdata)
	end
end

this is useful if we want to prefetch or update data
in cache, it doesn’t affect the lookup of closest known
zone cut

sets maximum UDP/EDNS payload within <1220, 65535>
the default is max unfragmented UDP packet, but it’s
possible to set it higher if the network supports it to avoid
TCP retransmits

todo: active refresh

DS keys are injected into current set (unmanaged)
DNSKEY keys are in the managed set and their RFC5011 state is tracked

todo:
- implement timers and this AddTime/RemTime
- active refresh
- move to a separate module