Sign responses to TSIG-signed UPDATEs (RFC 8945 §5.4.2)

When a request arrives with TSIG, attach a TSIG record to the response
so dns.ResponseWriter computes the MAC at write time using the secret
in TsigSecret. Without this, BIND nsupdate complains "expected a TSIG
or SIG(0)" on every UPDATE, even when the update applies successfully.

Two response paths fixed:
  - handleUpdate success/per-rcode replies (update.go)
  - ServeDNS rejection when TSIG verification fails (plugin.go)

The new helper in tsig.go is a no-op for unsigned requests. Unknown
keys still silently skip signing — we can't authenticate to a peer we
don't share a key with.

Tests verify both branches: signed request → response carries matching
TSIG (key name + algorithm); unsigned request → response stays plain.

update.go

@@ -29,6 +29,7 @@ import (
 func (p *RFC2136) handleUpdate(w dns.ResponseWriter, r *dns.Msg) (int, error) {
 	resp := new(dns.Msg)
 	resp.SetReply(r)
+	signResponseIfSigned(resp, r)
 
 	// 1. Validate the Zone section.
 	if len(r.Question) != 1 {