Keep a local copy of the OpenNIC root zone

[zquestz]

Follow-up to #125.

Problem

In OpenNIC mode, Unbound keeps no local copy of the root zone. Every root
delegation is a referral cached from whichever of the five OpenNIC root servers
answered, held for up to cache-max-ttl (86400). If one of those servers serves
stale or incomplete data for a TLD, that TLD can stop resolving until the entry
expires, even though the other four root servers are fine.

I hit this on a live deployment: .xyz stopped resolving while the rest of the
namespace was unaffected, and it stayed broken until Unbound was restarted,
which points at bad delegation data pinned in cache rather than a config or
network problem.

The ICANN path does not have this exposure, because it already keeps a local
copy of the root zone from internic.net via the existing auth-zone block. The
OpenNIC path was the only one iterating live against the root.

Change

Give OpenNIC mode the same treatment: an auth-zone for . slaved from the
root servers already listed in opennic.hints.

• The master list is generated from opennic.hints, so that file stays the
  single source of truth for which OpenNIC servers the resolver talks to.
  Refreshing the hints refreshes the masters, with no separate address to go
  stale independently.
• No new trust or availability dependency: the same five servers Unbound
  already uses for the root.
• fallback-enabled: yes, so a failed transfer falls back to querying the root
  servers directly, which is today's behavior. Worst case is no worse than now.
• The zone file is var/opennic-root.zone, distinct from the ICANN path's
  var/root.zone, so toggling OPENNIC on an existing container does not mix
  the two.
• The ICANN path is unchanged.

Testing

Verified on a live Kubernetes deployment with OPENNIC=1:

$ kubectl exec <pod> -- ls -l /opt/unbound/etc/unbound/var/opennic-root.zone
-rw-r--r-- 1 _unbound _unbound 2201431 /opt/unbound/etc/unbound/var/opennic-root.zone

Resolution works for both the OpenNIC TLDs and the regular namespace. Because of
fallback-enabled, working resolution is not by itself proof the transfer
happened, so the zone file above is the real check.