etc/config.*: tweak the config examples

See merge request knot/knot-resolver!729

The main impulse was to have 'hints > iterate', as people usually expect
hints to take precendence before cache.

- It was too aggressive.  Example I ran into: we have glue address
  in qry->ns but we want to find authoritative record by asking the NS.
- The anti-cycling measures are probably not perfect yet,
  but they seem to be fine enough and this commit seems
  very unlikely to make anything worse in practice.

daemon: proper processing of unsuccessful TLS rehandshake

See merge request knot/knot-resolver!728

daemon: addition to fd54dd5a, handle STUB in the same way as FORWARDING;

See merge request knot/knot-resolver!723

also improvement in NS election algorytm when using FORWARDING & STUB.

This is an attempt to separate kresd-specific tests from generic DNS
resolver tests.

Not all actions are destructive, but it seems generally expected that if
an earlier module or other code already transitioned the request into
a FAIL or DONE state, we don't want to apply rules anymore.
In particular, later rule actions would "overwrite" what previous
actions did.

It's perhaps still confusing that there are three distinct rule chains:
policy, view:tsig and view:addr.

Continue executing :addr rules until a non-chain action is executed.
Before this, the only the first match in view:addr rules got a chance,
even though the inner policy rule might not trigger in that case
or be a chain action.

policy: improve example for grafting subtrees

See merge request knot/knot-resolver!726

ci: run pytests with ASAN + fix con_flood

See merge request knot/knot-resolver!725

daemon: support Linux eBPF socket filters with new net.bpf_set(fd) and net.bpf_clear() bindings

See merge request knot/knot-resolver!719

daemon/bindings: eBPF socket filter support, fix broken RHEL/CentOS build; fix callbacks for map_walk()

daemon/io: additional integrity check

See merge request knot/knot-resolver!724