Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/permissions.md

@@ -27,8 +27,9 @@ certbot, CI jobs and backups.
 ## Grants
 
 A user's permissions are a list of grants. Administrators (`admin: true`)
-may do everything, and only they can manage users, see everyone's tokens
-and run `resync`.
+may do everything, and only they can manage users, see everyone's tokens,
+run `resync`, wipe a zone's DNSSEC keys, and use the registrar (Porkbun,
+whose key can move the domain).
 
 A grant is written as:
 
@@ -38,7 +39,7 @@ RESOURCE:ACCESS [zones=PATTERNS] [views=PATTERNS] [names=PATTERNS] [types=TYPES]
 
 | Resource | Covers |
 |----------|--------|
-| `zones` | zone definitions (create, delete, SOA, TTL, view) and zone options |
+| `zones` | zone definitions (create, delete, SOA, TTL, view, DNSSEC signing and the DS check) and zone options |
 | `records` | records in primary zones |
 | `views` | views and view options |
 | `acls` | ACLs |