Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -28,6 +28,8 @@ internal/
   nscheck/            DNS queries to other name servers: zone serials, the parent's delegation and DS records
   dnssec/             reads named's DNSSEC key and state files; DS records; the signing phases (docs/dnssec.md)
   porkbun/            Porkbun API client (name servers, glue, DS records) and an in-memory fake for tests
+  blocking/           blocklist parser, response policy zone writers, and matching a name the way named does
+                      (the downloads are in engine/blocklists.go)
   config/             jarld's YAML configuration
 deploy/               systemd units (jarld, the daily backup service and timer), sysusers.d and tmpfiles.d files
 deploy/debian/        the Debian package's control template and postinst/prerm/postrm