Run unbound-checkconf after unbound-anchor

Otherwise unbound.service won't start when the auto-trust-anchor file
(which would be created by unbound-anchor) is missing.
disable chroot in the default config

With chroot enabled (the default):
– the auto trust anchor file /var/lib/unbound/root.key is not available
– unbound has no access to /dev/random for entropy source

I don't think those problems can be solved in an elegant way and don't
think there is a big risk running this without a chroot.

chroot can always be enabled in a custom configuration
Set the auto-trust-anchor-file by default

This enables DNSSEC validation in the default config file.