{resolver,validator}: provide more EDE codes.

dnssec:

• Provide a way to retrieve whether a DNSKEY has the Zone Key Bit set, and add bindings for Lua modules (kr_dnssec_key_zonekey_flag), like kr_dnssec_key_sep_flag.
• In kr_ds_algo_support() provide a way to retrieve what is wrong with the keys.
• Check if a RRSIG RR has the signature expired already before inception time.

validator:

• Set EDE "Unsupported NSEC3 Iterations Value" when downgrading.
• Set EDE "Signature Expired before Valid" when checking RRSIGs.
• Set EDE "No Zone Key Bit Set" when a DNSKEY with the Zone Key Bit set to 0 is discarded.
• Instead of the generic "Other Error" with extra text "unsupported digest/key", set appropriate EDEs "Unsupported DNSKEY Algorithm" and "Unsupported DS Digest Type".

resolver:

• Set EDE "No Reachable Authority" when it is decided that all authoritative servers are unreachable or misbehaving.

Depends on/supersedes !1585 (merged).

daemon/lua/kres-gen-33.lua

@@ -489,6 +489,7 @@ int kr_ta_add(trie_t *, const knot_dname_t *, uint16_t, uint32_t, const uint8_t
 int kr_ta_del(trie_t *, const knot_dname_t *);
 void kr_ta_clear(trie_t *);
 _Bool kr_dnssec_key_sep_flag(const uint8_t *);
+_Bool kr_dnssec_key_zonekey_flag(const uint8_t *);
 _Bool kr_dnssec_key_revoked(const uint8_t *);
 int kr_dnssec_key_tag(uint16_t, const uint8_t *, size_t);
 int kr_dnssec_key_match(const uint8_t *, size_t, const uint8_t *, size_t);