Move local_unbound up in the rc order.

Approved by:	re (blanket)
Prevent resolvconf from updating /etc/resolv.conf.  As Jakob Schlyter
pointed out, having additional nameservers listed in /etc/resolv.conf
can break DNSSEC verification by providing a false positive if unbound
returns SERVFAIL due to an invalid signature.  The downside is that
the domain / search path won't get updated either, but we can live
with that.

Approved by:	re (blanket)
Free both KVA and backing pages when freeing TSS memory.

Reported and tested by:	pho
Sponsored by:	The FreeBSD Foundation
Approved by:	re (marius)
Correcting EXAMPLES section.

Approved by:	re (gjb)
Unbreak the WITHOUT_KERBEROS build and try to reduce the odds of a
repeat performance by introducing a script that runs configure with and
without Kerberos, diffs the result and generates krb5_config.h, which
contains the preprocessor macros that need to be defined in the Kerberos
case and undefined otherwise.

Approved by:	re (marius)