plugin/dynupdate: add durable authenticated RFC 2136 updates (#8520)

* plugin/dynupdate: add authenticated RFC 2136 updates

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

* plugin/dynupdate: fix README test fixtures

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

* test: format README fixture map

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

* plugin/dynupdate: persist updates and bound writable zones

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

* plugin/dynupdate: preserve middleware and fix interoperability fixtures

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

* test(dynupdate): validate Kea lifecycle and bounded zone costs

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

* plugin/dynupdate: reject duplicate directives and harden client fixtures

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

* plugin/dynupdate: fix update routing and startup validation

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

---------

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

plugin/cache/cache.go

@@ -54,6 +54,7 @@ type Cache struct {
 	// Positive/negative zone exceptions
 	pexcept []string
 	nexcept []string
+	bypass  []string // mutable authoritative zones discovered at startup
 
 	// Keep ttl option
 	keepttl bool
@@ -62,6 +63,12 @@ type Cache struct {
 	now func() time.Time
 }
 
+// ZoneBypasser identifies canonical authoritative zones that must always be
+// queried directly. Cache discovers implementations in its server block at startup.
+type ZoneBypasser interface {
+	CacheBypassZones() []string
+}
+
 // New returns an initialized Cache with default settings. It's up to the
 // caller to set the Next handler.
 func New() *Cache {