... upstreams list when closing outgoing connection

Continuation of the parent commit.  In particular, kr_nsrep_set()
can't be used to create NS list "with holes".

When decoding large packets, gnutls gives the application chunks
of size 16kb. So that tls session wirebuffer must be at least
KNOT_WIRE_MAX_PKTSIZE + 16kb.  (message re-formatted by vcunat)

Fixes #424.

To simplify this, some of the zonecut API was generalized
(API+ABI break).  Detected by -Wpedantic.

- building different version of kresd is not properly supported
  (uses current directory with checked-out code instead of git master)
- based on debian:stable instead of alpine for easier dependency
  resolution
- moved both Dockerfile and config to more appropriate locations

Metrics are collected and merged in http.prometheus, no need to be run
on every worker.

Minor changes to be blamed on Vladimir.

Minor changes to be blamed on Vladimir.

... done in the few preceding commits.
I intentionally don't mention ::daemon_context at this point.

The problem here was that we need to know which addresses are timed-out
(and not to be re-probed) much earlier than we do NS selection ATM -
that's because under some circumstances it affects the depth of NS
zone cut that we choose, i.e. if all addresses in a certain zone cut are
"bad" in a certain sense, we need to use a zone cut closer to the root,
because otherwise we'd get into a dependency cycle.

It fired also when the name didn't contain the final dot.

I believe that's what most users want; practical motivation:
https://forum.turris.cz/t/kresd-responds-to-hints-with-nxdomain-for-aaaa-requests/8353

When suspect SIGBUS happens, print helpful error and try to remove
the cache, so that the service might work again if auto-restarted.
Theoretically we could longjmp() out of the SIGBUS handler,
but that would be rather messy, so let the process die.

We need to think about the API carefully.

- fix some edge cases and nitpicks
- static storage -> stack (for temporaries of a few kilobytes)
- sync docs, including caveats of the implementation

i.e. those not managed via RFC 5011.
The verbose log format is changed a bit, consequently.

Let's see if it helps against confusion with "Knot DNS" authoritative
server or not.

I intentionally didn't mark the function names as code or similar,
as changing formatting every other word seemed too visually distracting.

... thanks to new API in libknot-2.7.
Apart from being simpler, it now rotates even uncached answers.

The catch is that during configuration file processing,
no cache is open (yet), as kresd can't know if the config
does open it in some later part (with non-default path or size).
Now we just throw an error.  Exceptions:
 - cache.open() and cache.backends(), of course :-)
 - cache.ns_tout() - not required, it's not really inside cache
 - cache.close() - it sounds reasonable to allow "closing a closed cache"

This immediately caught a typo in cache metatable.

(cherry picked from commit 54797e88)

This should fix #385: possible floods with
> scheduling rotation check in 0 ms

Starting multiple systemd units with a target is conceptually cleaner
than using globbing expression.

Related https://github.com/systemd/systemd/issues/9080