Rework validate-by-DS to avoid DoS vuln without arbitrary limits.

By calculating the hash of a DNSKEY once for each digest algo,
we reduce the hashing work from (no. DS) x (no. DNSKEY) to
(no. DNSKEY) x (no. distinct digests)

The number of distinct digests can never be more than 255 and
it's limited by which hashes we implement, so currently only 4.

src/option.c

@@ -5870,8 +5870,6 @@ void read_opts(int argc, char **argv, char *compile_opts)
   daemon->host_index = SRC_AH;
   daemon->max_procs = MAX_PROCS;
 #ifdef HAVE_DNSSEC
-  daemon->limit_key_fail = LIMIT_KEY_FAIL;
-  daemon->limit_ds_fail = LIMIT_DS_FAIL;
   daemon->limit_sig_fail = LIMIT_SIG_FAIL;
   daemon->limit_crypto = LIMIT_CRYPTO;
   daemon->limit_work = DNSSEC_WORK;