DnssecDnsHandle: check RRSIG validity as per RFC4035

[japaric]

this PR adds the validity checks specified in section 5.3.1 of RFC4035, including the time check that was reported as missing in issue #2209

these new checks overlap with some of the existing ones but I opted for not removing the existing ones because I do not know how well the existing code is covered by tests.

I checked that I did not break this query:

let config = ResolverConfig::default();
let mut opts = ResolverOpts::default();
opts.validate = true;

let resolver = Resolver::new(config, opts)?;

let lookup = resolver.lookup("example.com.", RecordType::A)?;
lookup.record_iter().for_each(|record| {
    assert_eq!(Proof::Secure, record.proof());
});

It would be good to check that expired signatures are rejected. There are plans to add those kind of tests to the conformance test suite (ferrous-systems/dnssec-tests#61) but given that Recursor does not use DnssecDnsHandle those tests won't exercise the code paths added here. I'm looking into reusing some of the existing code in DnssecDnsHandle to implement DNSSEC validation in Recursor (then conformance tests will cover some of DnssecDnsHandle code) but that's still ways off time-wise.

Another way to check the code here end to end would be to modify util/src/bin/resolve.rs to do DNSSEC validation (e.g. via a new CLI flag) then it would behave just like delv. That updated resolve could be comparatively against delv using the dns-test framework, that is without relying on external services / the internet.

I'm leaving this in draft state because the implementation will be cleaner when #2211 is implemented.

[japaric]

rebased and ready for review