Re-parallelize full signing

[bal-e]

This is a relatively simple implementation for parallelized RRSIG generation.

To recap: we would ideally take the unsigned records (which are sorted in DNSSEC canonical order), split them into arbitrary chunks, and then sign each chunk. But (currently) we sign each chunk using sign_sorted_zone_records(), which expects to receive the full zone and sign it serially. To work around this, we need to find chunks that sign_sorted_zone_records() can correctly consume. More specifically, we need to find valid boundaries between chunks. The primary complication here is from zone cuts; sign_sorted_zone_records() will traverse the records it is given, look for zone cuts, and ignore any records below those cuts.

In this PR, valid boundaries are defined based on top-level labels; the last label before the zone apex within record owners. For example, the records foo.example.org, a.foo.example.org, and bar.example.org (in the zone example.org) have top-level labels foo, foo, and bar, respectively. I have defined valid chunk boundaries to lie between top-level labels, so that foo.example.org and a.foo.example.org cannot have a boundary between them, but a.foo.example.org and bar.example.org can.

This is a good definition with respect to performance because big TLDs (where parallelization matters most) will tend to have many distinct top-level labels. I believe it is sound because zone cuts never extend across top-level labels.

Future considerations

1. We may unify the implementation and parallelization of the low-level cryptographic signing between the incremental and full signer, with some kind of signing backend. This should be orthogonal to the chunk detection algorithm here.

2. We may change the zone data structures to separate glue records and authoritative records. This would eliminate the need for this chunk boundary algorithm -- we could traverse over only the authoritative records, and then valid chunk boundaries would just be RRset (or perhaps owner name) boundaries.

---

• If you are changing Rust code or integration tests (Cargo.*, crates/, etc/, integration-tests/, src/):
  • Did you run the integration tests with act through the act-wrapper (as described in TESTING.md)?