Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/stats.md

@@ -102,10 +102,14 @@ lists, views, zones). named's own counters can't be filtered.
 | `view:NAME` | response log | answers per view (`_default` without views) |
 | `zone:NAME` | response log | answers per local zone; `zone:-` for names in none of your zones |
 | `responses` | response log | lines read (a health check) |
+| `blocked`, `blocklist:NAME` | response log | queries [blocking](blocking.md) answered, and by which list (`blocklist:rules` for your own rules) |
 
 **Top lists** (per hour and per day, the `top_n` largest): `name` (most
 queried names), `client`, `nxdomain` (names answered NXDOMAIN), `servfail`
-(names answered SERVFAIL), `refused` (clients that were refused).
+(names answered SERVFAIL), `refused` (clients that were refused), `blocked`
+(names blocking answered). Blocked answers are NXDOMAIN too, but they
+aren't counted as names that don't exist: not in the `nxdomain` list, and
+not in the summary's NXDOMAIN ratio.
 
 Nothing else is stored. In particular there's no per-query record, so you
 can't look up "who asked for X at 14:02". That is deliberate, both for size