Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/catalog/catalog.go

@@ -102,13 +102,25 @@ var managed = map[string]map[string]string{
 		"match-recursive-only": "the view's match-recursive-only field",
 		"key":                  "TSIG keys (define keys at the top level)",
 		"zone":                 "zones",
+		"dnssec-policy":        dnssecManaged,
+	},
+	ScopeOptions: {
+		"dnssec-policy": dnssecManaged,
 	},
 }
 
+// dnssecManaged: Jarl turns signing on and off per zone, so that it can
+// guard the steps (a zone mustn't go unsigned while the parent zone still
+// has a DS record for it). dnssec-policy statements that define custom
+// policies (at the top level) are still options.
+const dnssecManaged = "each zone's DNSSEC setting (jarl zone dnssec enable ZONE; see docs/dnssec.md)"
+
 var zoneManaged = map[string]string{
-	"type":    "the zone's type field",
-	"file":    "the zone's file (generated by Jarl)",
-	"in-view": "the zone's in-view field",
+	"type":          "the zone's type field",
+	"file":          "the zone's file (generated by Jarl)",
+	"in-view":       "the zone's in-view field",
+	"dnssec-policy": dnssecManaged,
+	"key-directory": "Jarl (signed zones keep their keys in Jarl's key directory, which its backups include)",
 }
 
 // synonyms are older spellings that named 9.20 still accepts.