Debian bug closure.
Fix endian bug in --local-service code.
Fix length->netmask conversions to avoid undefined behaviour.
Fix bug when resulted in NXDOMAIN answers instead of NODATA.

check_for_local_domain() was broken due to new code matching F_*
bits in cache entries for DNSSEC. Because F_DNSKEY | F_DS is
used to match RRSIG entries, cache_find_by_name() insists on an exact match
of those bits. So adding F_DS to the bits that check_for_local_domain()
sends to cache_find_by_name() won't result in DS records as well
as the others, it results in only DS records. Add a new bit, F_NSIGMATCH
which suitably changes the behaviour of cache_find_by_name().
Fix bug which caused dnsmasq to become unresponsive when an interface goes.
Fix CHANGELOG entry under wrong version.
add min-cache-ttl option