Add DNSSEC signing, key backups and Porkbun support

Zones get a DNSSEC setting: named signs them with BIND's default (or a
custom) dnssec-policy and inline signing, with keys in a per-view key
directory. Jarl shows the keys, the DS record and when it is safe to
publish it, checks the parent's DS records (check-ds, which also tells
named), and refuses steps that would break a signed domain: switching
straight to unsigned, finishing a turn-off too early, deleting or moving
a signed zone, TTLs above max-zone-ttl. Turning off goes through the
insecure policy; wipe starts over once the parent has no DS.

Backups store the DNSSEC keys and restore puts them back for named; the
backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's
serial above named's whenever it writes an older one (after a restore).
The serials check compares the signed serial.

With a Porkbun API key in jarl.yaml, the registrar's name servers, glue
records and DS records can be shown and changed, each change checked
first (dry run, force to override).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dnssec/testdata/Kfast2.test.+013+28643.state

@@ -0,0 +1,21 @@
+; This is the state of key 28643, for fast2.test.
+Algorithm: 13
+Length: 256
+Lifetime: 0
+KSK: yes
+ZSK: yes
+Generated: 20261008203340 (Thu Oct  8 20:33:40 2026)
+Published: 20261008203340 (Thu Oct  8 20:33:40 2026)
+Active: 20261008203340 (Thu Oct  8 20:33:40 2026)
+Retired: 20261008203344 (Thu Oct  8 20:33:44 2026)
+Removed: 20261024213844 (Sat Oct 24 21:38:44 2026)
+PublishCDS: 20261008203354 (Thu Oct  8 20:33:54 2026)
+DNSKEYChange: 20261008203344 (Thu Oct  8 20:33:44 2026)
+ZRRSIGChange: 20261008203344 (Thu Oct  8 20:33:44 2026)
+KRRSIGChange: 20261008203344 (Thu Oct  8 20:33:44 2026)
+DSChange: 20261008203340 (Thu Oct  8 20:33:40 2026)
+DNSKEYState: unretentive
+ZRRSIGState: unretentive
+KRRSIGState: unretentive
+DSState: hidden
+GoalState: hidden