allow single-host update secrets, make dnstools tests work for everybody

the nsupdate.info zone is configured to allow updating test.nsupdate.info with a non-secret key used for the tests.
we also have a test that tries to update another host with that key and checks that this fails.

change the tests so they only use test.nsupdate.info (if possible).

single-host update secrets need a Domain record for the fqdn of this single host, the fqdn is tried first, before it tries the origin zone.
if a dns update give a rcode != NOERROR, we log it and raise a DnsUpdateError, dyndns2 result code: "dnserr REASON" (also shown on web ui)
update bind9 configuration example / view