Replace disable_dns_lookups with backwards-compatible smtp_dns_support_level.

The new parameter can be empty (compatible) or else one of "disabled",
"enabled" or (if libresolv include files cooperate) "dnssec".

Plus documentation, and integration into the SMTP delivery agent:

    - When the level is "dnssec" enable DNSSEC lookups for MX records
      and any securely known hostnames.
    - When hostnames are securely validated, use the resolved hostname
      to name the SMTP session and to control TLS policy.
    - Pass the DNSSEC validation flag to smtp_session_alloc().

Related change to tls_dane.c to document tls_dane_avail() and make
it dependent on the required libresolv features.
Split off session TLS policy parameters to a new structure.

We add a pointer to an SMTP_TLS_SESS to SMTP_SESSION to replace the
bunch of directly stored TLS parameters.

The SMTP_TLS_SESS structure is managed by a new module (which behaves
identically, after this commit, apart from the indirection).

This simplifies upcoming work.
Allow smtp_session_alloc() to fail gracefully and report an error.

With DANE TLS lookups contributing to TLS policy lookups DNS lookup
errors make this much more likely, so we need to return an suitable
DSN error structure from smtp_tls_sess_alloc() via smtp_session_alloc().
Add ctable_refresh.

Applications that store TTLs in the cached values can request that
a stale entry to flushed and a new one fetched.
Documentation of new DANE level and new parameters.
Implemented and enabled DANE security level.