Initial implementation of RRL.

Based on memo and implementation notes from
Vixie and Schryver.
http://ss.vix.su/~vixie/isc-tn-2012-1.txt

Basically a token bucket algorithm, no interpolation
yet. Classification of responses based on:
<address prefix, resp.class, name, seed>

address prefix = /24 for IPv4, /56 for IPv6
resp.class = based on rcode,question and ancount
name = either qname or answer
seed = secret to harden collision prediction

No SLIP yet.
Added murmurhash3 for hashing (ported from htrie).
Fixed subnet hashing code for RRL classification.
Implemented RRL collsision checking and slow-start.

When a collision occurs (bucket is same, but addresses differ),
bucket enters a slow-start mode.
This means it is given less tokens for two seconds in a row,
then leaves the slow-start mode.
Reason for this is penalize collisions, but still allow
legitimate clients to connect.
In usual mode of operations collisions on the same bucket shouldn't
happen in a regular fashion, therefore not triggering slow-start
mode often.
Packet API now contains uint16_t flags (now used for marking wildcard ans).
Implemented RRL classification and using name for hashing.

Basic classes (evaluated in following order):
* NORMAL - positive answer
* ERROR - rcode is not NXDOMAIN nor NOERROR
* NXDOMAIN - rcode is NXDOMAIN
* EMPTY - response doesn't contain any answers
* LARGE - packet size exceeded threshold (currently 1k)
* WILDCARD - answering from a wildcard

Reason behind not selectively classifying popular types like
DNSKEY, RRSIG or ANY is that any type could be exploited,
depending on the contents of the zone.

refs #2136
Minor fixes and revents sanitization for fdset/kqueue.
Implemented distributed locking to RRL.

RRL could be updated from any answering thread
and due to the natural collisions, even one bucket.
As every query also updates the bucket, it would be inefficient
to sync all threads using RCU. For this reason N muteces
are allocated and appropriate mutex is calculated from the
id of the bucket (currently last digit).

refs #2136
Added RRL config options, added to server startup.

refs #2136
Wrapper around used RRL locking scheme.

refs #2136
Store packet flags from parsing in query packet.

As response packet is temporary at the moment,
copy flags/markers from the response to the query
when parsing.

refs #2136
Fixed server instance not being properly initialized.

refs #2136
Changed RRL API, implemented for UDP handler.

Now works when enabled in configuration.
No smoothing to precision better than 1s yet.
SLIP also implemented.

refs #2136
Responses to ANY should contain RRSIGs.

fixes #2363 @15m
Ignoring removal from non-existing node in DDNS.

fixes #2361 @30m
New RRL classes, fixed logging, buckets cannot reset when in sstart.

New classes:
* ANY (for ANY qtype)
* DNSSEC (for qtype = DNSSEC-related record)

Now logging when netblock enters/leaves rate limiting.
Calculated by the previous window when dt>0 and number of
available tokens is zero.

Buckets under a slow-start phase cannot reset on subsequent collisions,
this is to avoid potential collision attack when two precalculated
packets hit the same bucket regularly.
This could happen in a legitimate traffic as well (less probably),
if it does, the clients won't get completely denied, but will share
the remaining rate until the slow-start phases out (1 time window).

refs #2136
Rate limiting rate message.

refs #2136
Fixed default RRL size, missing manpage entry.

refs #2136
Debugging messages for RRL.

refs #2136
Update RRL logging, small fixes for cls/flags clash.

refs #2136