Add support for dynamic updates (RFC2136)

Implementation of #18. This is still WIP and the commits need cleaning up, but progress is steady.

- [x] Support for TSIG shared secrets for _per zone_ authentication
- [x] Support for atomic updates (all updates and prerequisites are locked for the duration of the request)
    - [x] Also works across multiple nameservers for high availability setups (+1 etcd)
- [ ] Support for prerequisites
- [ ] Support for all types of DNS updates
- [ ] Test cases for the various updates and prerequisites supported
- [ ] Documentation