extended DNS errors support

See merge request !1234

To allow for easier debugging, each origin of an extended DNS error has
a unique 4-byte identifier that is included in the extra_text message.

The identifiers are random 4-letter base32 strings, generated with:
base32 /dev/random | head -c 4

Add a utility function for simpler lua API when setting extended errors.

Version 2.9 isn't supported anymore anyway, but 3.0.2 is needed for
extended error constants.

kr_dnskeys_trusted() only returns EINVAL, ENOENT or EOK.

We don't need this on the versions before nix 2.4,
but let's switch now already.

iterate: fix bad zone_cut update in a rare case

See merge request !1237

https://forum.turris.cz/t/kresd-name-unresolution/16275

Example problematic query during QNAME minimization:
```
[resolv][43578.24]   => id: '08532' querying: 'ns-921.amazon.com.'@'34.196.62.143#00053' zone cut: 'aws.amazon.com.' qname: 'coNsOlE.aWs.AmAzON.Com.' qtype: 'NS' proto: 'udp'
[iterat][43578.24]   <= answer received:
;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 8532
;; Flags: qr aa  QUERY: 1; ANSWER: 4; AUTHORITY: 1; ADDITIONAL: 0

;; QUESTION SECTION
console.aws.amazon.com.         NS

;; ANSWER SECTION
console.aws.amazon.com. 600     NS      ns-921.amazon.com.
console.aws.amazon.com. 60      CNAME   us-east-1.console.aws.amazon.com.
us-east-1.console.aws.amazon.com. 600   NS      ns-921.amazon.com.
us-east-1.console.aws.amazon.com. 60    CNAME   gr.console-geo.us-east-1.amazonaws.com.

;; AUTHORITY SECTION
us-east-1.amazonaws.com.        60      SOA     ns-921.amazon.com. root.amazon.com. 1638962488 3600 900 7776000 60

[iterat][43578.24]   <= rcode: NXDOMAIN
```

Here the zone_cut would get updated to us-east-1.console.aws.amazon.com.
breaking further resolution towards    eu-west-3.console.aws.amazon.com.

release 5.4.3

See merge request !1236

nitpicks

See merge request !1235

lua: add parse_rdata() utility function

See merge request !1233

Credit for code goes to Vladimír Čunát

renumber and reroute: documentation updates

See merge request !1232