Give every view a TSIG key that selects it

Each view's match-clients starts with "key jarl-view-NAME" (after
"!key" for the views listed after it), so a query signed with a view's
key lands in that view from any address. The secrets are derived from a
random seed in Jarl's database. The delegation check signs its queries
to this server's own addresses with the key of the zone's view: before,
they got whichever view matched the server's address, usually internal.
jarl view key / GET /views/{id}/key show a key for dig -k (tsig:write,
audited). jarl-view- key names are reserved; the importer drops view
keys from a configuration Jarl wrote.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -297,6 +297,13 @@ contains "token.revoke"
 run "view create (adopts zones)" 0 $J view create internal --match-clients homelab --adopt-zones
 run "view create external" 0 $J view create external --match-clients any
 run "zone create in external" 0 $J zone create adbraun.test --view external --ns ns1.adbraun.test. --record "ns1 A 203.0.113.1"
+# View keys: a query signed with a view's key lands in that view, from
+# any address (this host is in homelab, so unsigned it gets internal).
+run "view key" 0 sh -c "$J view key external --named-conf > $E/external.key"
+expect_dig "unsigned from here: the internal view" "127.0.0.1" ns1.adbraun.test A
+expect_dig "signed with the external view's key" "203.0.113.1" -k $E/external.key ns1.adbraun.test A
+run "view key shows a dig command" 0 $J view key external
+contains "dig -y hmac-sha256:jarl-view-external:"
 # named-checkconf's own warnings stay on the dashboard after the apply.
 run "option set recursion no (external)" 0 $J option set recursion no --view external
 run "allow-recursion without its braces" 0 $J option set allow-recursion 192.0.2.1 --view external