extended DNS errors support

Credit for the original prototype (!794 (closed)) goes to Stéphane Bortzmeyer and Vladimír Čunát. Supersedes !794 (closed).

---

EDE codes

Used

• 0 - Other
• 3 - Stale Answer
• 4 - Forged Answer
• 6 - DNSSEC Bogus
• 7 - Signature Expired
• 8 - Signature Not Yet Valid
• 10 - RRSIGs Missing
• 12 - NSEC Missing
• 15 - Blocked
• 18 - Prohibited
• 20 - Not Authoritative
• 21 - Not Supported
• 22 - No Reachable Authority

Ununsed

• 1 - Unsupported DNSKEY Algorithm: we use Other(0) instead
• 2 - Unsupported DS Digest Type: we use Other(0) instead
• 5 - DNSSEC Indeterminate
• 9 - DNSKEY Missing: we use DNSSEC Bogus(6) instead
• 11 - No Zone Key Bit Set: we use DNSSEC Bogus(6) instead
• 13 - Cached Error
• 14 - Not Ready
• 16 - Censored: possible to use with DENY_MSG
• 17 - Filtered: possible to use with DENY_MSG
• 19 - Stale NXDOMAIN Answer: we use Stale Answer(3) instead
• 23 - Network Error
• 24 - Invalid Data

---

TODOs

• figure out remaining TODOs in code
• do we want any test coverage? how?

ci/debian-11/Dockerfile

@@ -36,8 +36,10 @@ RUN pip3 install --upgrade pip
 RUN pip3 install pylint
 RUN pip3 install pep8
 RUN pip3 install pytest-xdist
+# FIXME replace with dnspython >= 2.2.0 once released
+RUN pip3 install git+git://github.com/bwelling/dnspython.git@72348d4698a8f8b209fbdf9e72738904ad31b930
 # tests/pytest dependencies: skip over broken versions
-RUN pip3 install 'dnspython != 2.0.0' jinja2 'pytest != 6.0.0' pytest-html pytest-xdist
+RUN pip3 install jinja2 'pytest != 6.0.0' pytest-html pytest-xdist
 # apkg for packaging
 RUN pip3 install apkg