Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/systemd/jarl-backup.service

@@ -1,4 +1,5 @@
-# Jarl: one database backup, run daily by jarl-backup.timer.
+# Jarl: one database backup (with the DNSSEC keys), run daily by
+# jarl-backup.timer.
 # Installed as /etc/systemd/system/jarl-backup.service (see
 # docs/operations.md#backups). What to keep, and where, is in the backup:
 # section of /etc/jarl/jarl.yaml; when it runs is in jarl-backup.timer.
@@ -28,8 +29,12 @@ PrivateTmp=yes
 PrivateDevices=yes
 PrivateNetwork=yes
 NoNewPrivileges=yes
-CapabilityBoundingSet=
-AmbientCapabilities=
+# Read access to every file, and nothing else: named's DNSSEC private keys
+# (under /var/lib/bind/jarl/dnssec-keys) are readable only by named's user,
+# and the backup includes them. Everything outside the paths above stays
+# read-only (ProtectSystem=strict).
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH
+AmbientCapabilities=CAP_DAC_READ_SEARCH
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes