extended DNS errors support

Credit for the original prototype (!794 (closed)) goes to Stéphane Bortzmeyer and Vladimír Čunát. Supersedes !794 (closed).

---

EDE codes

Used

• 0 - Other
• 3 - Stale Answer
• 4 - Forged Answer
• 6 - DNSSEC Bogus
• 7 - Signature Expired
• 8 - Signature Not Yet Valid
• 10 - RRSIGs Missing
• 12 - NSEC Missing
• 15 - Blocked
• 18 - Prohibited
• 20 - Not Authoritative
• 21 - Not Supported
• 22 - No Reachable Authority

Ununsed

• 1 - Unsupported DNSKEY Algorithm: we use Other(0) instead
• 2 - Unsupported DS Digest Type: we use Other(0) instead
• 5 - DNSSEC Indeterminate
• 9 - DNSKEY Missing: we use DNSSEC Bogus(6) instead
• 11 - No Zone Key Bit Set: we use DNSSEC Bogus(6) instead
• 13 - Cached Error
• 14 - Not Ready
• 16 - Censored: possible to use with DENY_MSG
• 17 - Filtered: possible to use with DENY_MSG
• 19 - Stale NXDOMAIN Answer: we use Stale Answer(3) instead
• 23 - Network Error
• 24 - Invalid Data

---

TODOs

• figure out remaining TODOs in code
• do we want any test coverage? how?

lib/dnssec/signature.c

@@ -274,11 +274,7 @@ int kr_check_signature(const knot_rdata_t *rrsig,
 		goto fail;
 	}
 
-	ret = dnssec_sign_verify(sign_ctx,
-		#if KNOT_VERSION_MAJOR >= 3
-			false,
-		#endif
-			&signature);
+	ret = dnssec_sign_verify(sign_ctx, false, &signature);
 	if (ret != 0) {
 		ret = kr_error(EBADMSG);
 		goto fail;