sinksmtp: correct generation of DNS status
sinksmtp: improve tests; more comments, add tests of DNS status generation

Since I realized that it had a bug, I should actually be testing it
formally.
sinksmtp: try to fix and document a corner case in rules evaluation order

It turns out that my previous approach to what rules could be skipped
and what rules had to be evaluated during a rules check was broken.
The new rules are much simpler and I think they work, and corner cases
are both realized and documented:

* a rule with an explicit phase is evaluated only in that phase.
* you can now explicitly 'defer' rules to the phase that they normally
  require. This used to be silently removed by the parser as something
  that was pointless; well, it's not any more.
* all rules that don't have an explicit phase are always evaluated,
  even if they're stall or reject rules. There are situations where
  this is necessary and it cleans up the logic.

Hopefully the code now reflects this logic.

I should probably rename 'deferto' and update comments because
these aren't really deferred rules any more, they're now rules
with a set phase. But let's defer that to later.
sinksmtp: improve the logic around do-nothing clients

In particular we now don't count failed TLS setup against potential
do-nothing clients.