Fix crash in DNSSEC code when attempting to verify large RRs.
Make caching work for CNAMEs pointing to A/AAAA records shadowed in /etc/hosts

If the answer to an upstream query is a CNAME which points to an
A/AAAA record which also exists in /etc/hosts and friends, then
caching is suppressed, to avoid inconsistent answers. This is
now modified to allow caching when the upstream and local A/AAAA
records have the same value.
Fix problems validating NSEC3 and wildcards.
Initialise return value.
add min-cache-ttl option

Signed-off-by: aa65535 <aa65535@live.com>

Sometimes, we need to control the DNS cache TTL.