Up till now we would only chase 1 CNAME. Spec requires we will chase
all. This PR add support for this. Up to 8 CNAMEs are chased (this
could be longer, by just checking for cycles, but 8 seems enough for
now).
Also add RRSIG of the first CNAME for DNSSEC.
The DS record is handled specially in the server ServeDNS mux, but there
was no code that actually called the correct middleware handler chain
when encountering a DS.
This PR fixes that behavoir, additonal bugs has been files to look into
how we are handling delegation (secure and non-secure ones).
