unbound: Vendor import 1.20.0

Release notes at
https://www.nlnetlabs.nl/news/2024/May/08/unbound-1.20.0-released/

Security: The DNSBomb vulnerability CVE-2024-33655

Merge commit 'c2a80056864d6eda0398fd127dc0ae515b39752b' into main

unbound: Vendor import 1.19.3

Release notes at
https://www.nlnetlabs.nl/news/2024/Mar/14/unbound-1.19.3-released/

MFC after: 1 week

Merge commit '5a33598e88ad8fbc0affa74dee0a2d8cc4010fbc' into main

Clean up the libunbound build to avoid accidentally regenerating the
configuration lexer and parser during buildworld. Instead of being
included in the source as it is in the upstream distribution, the code is
now always generated (in ${.OBJDIR}) at build time.

PR: 190739
MFC after: 1 week

Import unblock-lan-zones feature backported from upstream svn trunk.
This is a partial fix for reverse lookups in RFC 1918 networks. With
this option enabled, unbound no longer ignores these queries; however,
it will still reject the answer it gets from the forwarder, because
the RFC 1918 reverse zones are signed.

Submitted by: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>

Upgrade to latest ldns (1.6.17) and unbound (1.4.22).

MFC after: 3 weeks

Due to a missing command-line argument, yacc regenerated the parser but
not its header file, resulting in a mismatch between the lexer and parser
and strange errors when reading the configuration file.

Approved by: re (blanket)

Upgrade to 1.4.20.

Minimal subset of the unbound sources.

unbound: Vendor import 1.19.3

Release notes at
https://www.nlnetlabs.nl/news/2024/Mar/14/unbound-1.19.3-released/

MFC after: 1 week

Merge commit '5a33598e88ad8fbc0affa74dee0a2d8cc4010fbc' into main

Clean up the libunbound build to avoid accidentally regenerating the
configuration lexer and parser during buildworld. Instead of being
included in the source as it is in the upstream distribution, the code is
now always generated (in ${.OBJDIR}) at build time.

PR: 190739
MFC after: 1 week

Import unblock-lan-zones feature backported from upstream svn trunk.
This is a partial fix for reverse lookups in RFC 1918 networks. With
this option enabled, unbound no longer ignores these queries; however,
it will still reject the answer it gets from the forwarder, because
the RFC 1918 reverse zones are signed.

Submitted by: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>

Upgrade to latest ldns (1.6.17) and unbound (1.4.22).

MFC after: 3 weeks

Due to a missing command-line argument, yacc regenerated the parser but
not its header file, resulting in a mismatch between the lexer and parser
and strange errors when reading the configuration file.

Approved by: re (blanket)

Upgrade to 1.4.20.

Minimal subset of the unbound sources.