DNS64 for subnets

RIPE NCC and Ondřej Caletka expressed demand for ability to limit which subnets are covered by DNS64.

We need to think whether this should be generalized to some form of ACL like in BIND, or if another one-off for DNS64 is okay.

RIPE NCC wanted the equivalent of the Bind ACL options:

acl nat64-users {
    2001:67c:64:49::/64;
};
options {
    dns64 64:ff9b::/96 {
              clients { nat64-users; };
    };
};

Their own hack used this config:

-- RIPE NCC DNS64 config
ripencc.dns64_proxy('64:ff9b::')
ripencc.dns64_subnet('2001:67c:64:49::/64')