Add blocking: blocklists and block/allow rules with BIND response policy zones

jarld downloads blocklists (Adblock, hosts or plain domains), checks them
daily and reloads named only when a list changed; your own block and
allow rules take precedence, and the most specific rule wins. Lists and
rules apply per view (default: every view that offers recursion). Web UI
Blocking page with name checks, jarl blocklist and jarl block, the
/blocking API, blocked counts in the statistics. Database schema 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/validate/validate.go

@@ -137,6 +137,7 @@ func State(s *model.State, opts Options) []Problem {
 	c.checkOptions()
 	c.checkSecurity()
 	c.checkDNSSEC()
+	c.checkBlocking()
 	sortProblems(c.problems)
 	return c.problems
 }