H6/H7/M3/M4/M7: hardening + behavior documentation

H6 — TSIG replay-window test. New TestCheckTSIG_BadStatus_Refused
verifies that when miekg/dns reports a TSIG verification failure via
ResponseWriter.TsigStatus (the channel for fudge-window violations,
bad MACs, expired timestamps), our plugin refuses. The fudge tolerance
itself is miekg/dns's default (300s); documented in tsig.go so
operators know the dependency.

H7 — No-op UPDATE policy: documented explicitly in update.go. We do
NOT bump the SOA on a no-op (deduped) UPDATE — forcing downstream
secondaries to AXFR identical content wastes bandwidth and contradicts
RFC 2136's intent. Callers wanting to force a serial bump can send a
throwaway add+delete pair (touch-UPDATE pattern).

M3 — Delete-by-exact-match ignores TTL and class per RFC 2136 §2.5.4.
The previous rr.String() comparison included TTL, so an UPDATE with
CLASS=NONE TTL=0 (the protocol-required encoding for a delete) failed
to match stored RRs at CLASS=IN with non-zero TTL. Now we normalize
both sides (TTL=0, class=IN) before invoking dns.IsDuplicate.

M4 — validateZoneFiles now actually parses each zone at startup
(loadRRs invocation). Previously it only stat()'d the file; corrupt
zone content sailed through startup and produced SERVFAIL on the first
UPDATE with no startup-time signal. Combined with H3+H4's invariant
checks, this turns silent zone corruption into immediate startup
failure.

M7 — Commit-message sanitization. RR names are attacker-controlled
(TSIG only authenticates the sender; the payload is hostile by
default). Control characters in commit messages could inject newlines
into git log or ANSI sequences into downstream log renderers. New
sanitizeForCommitMessage escapes \n, \r, \t, and other C0 controls.

New tests:
- TestCheckTSIG_BadStatus_Refused (H6)
- TestUpdate_DeleteRR_IgnoresTTL (M3)
- TestSanitizeForCommitMessage (M7)

tsig.go

@@ -86,6 +86,16 @@ func (p *RFC2136) checkTSIG(w dns.ResponseWriter, r *dns.Msg) error {
 	// A nil from TsigStatus means verification succeeded; any non-nil
 	// error means the signature was invalid, the time was outside the
 	// fudge window, or some other auth failure.
+	//
+	// H6 — Replay window: the TSIG `fudge` field (RFC 8945 §5.2) is the
+	// allowed clock skew between client and server. miekg/dns enforces
+	// this in TsigVerify (rejecting with ErrTime if the request's time
+	// is too far from local time). We rely on miekg/dns's default
+	// tolerance (currently 300s); we do not configure it ourselves.
+	// If miekg/dns's default ever changes, our replay-window behavior
+	// changes with it — operators should monitor upstream release notes.
+	// A future enhancement is to make the fudge configurable via the
+	// Corefile (e.g., `tsig-fudge 300`).
 	if status := w.TsigStatus(); status != nil {
 		return fmt.Errorf("TSIG verification failed for key %q: %w", keyName, status)
 	}