subrequests may be insecure (e.g. out of bailiwick insecure NS),
but the final answer may be secured
the commit also fixes caching in this case

the reason is that it's not actively used since we moved to binary
testing, and it depends on libknot internal api that has changed
also removed several unused libknot internal headers

the module can enforce RPZ from zone file, later a LMDB binary database
is going to come to solve following:
- updating zones on the fly
- instant startup (although it loads 1M blocklist in a fraction of
second)
- no extra memory usage between multiple processes
the compatibility notes are in the documentation

module can identify clients based on their source address or used TSIG
key

based on _BSD_SOURCE timersub macro

this provides a useful callback for per-request operations that can’t wait until the query is completed (e.g. blocking or logging started queries)

the stats module keeps track of frequent iterative queries using
probabilistic sampling. the list includes subrequests.
it is useful for tracking over time, prefetching and anomaly reporting

enumerated metrics are always present (set to 0 if not used), this fixes
missing values when not measuring and provides a faster access to common
data

the only flag supported now is the KR_REQ_DNSSEC,
which indicates that the caller wants a secure answer