Fix crash in DNSSEC code when attempting to verify large RRs.
Make caching work for CNAMEs pointing to A/AAAA records shadowed in /etc/hosts

If the answer to an upstream query is a CNAME which points to an
A/AAAA record which also exists in /etc/hosts and friends, then
caching is suppressed, to avoid inconsistent answers. This is
now modified to allow caching when the upstream and local A/AAAA
records have the same value.
Fix problems validating NSEC3 and wildcards.
Initialise return value.