Improve suppression of TLSA lookups in insecure zones.

This is now applied not only to non-MX destinations, but also to
each MX record.

At the same time raise the posttls-finger default connect and banner
timeout to 30 seconds.  The previous 5 second default was too short
for many sites that impose longer sleep delays.