0.3.0

Security fixes from the review of 0.2.0, plus a fact-check of the docs.

• CNAME MX hosts: TLSA is looked up at the expanded name of a DNSSEC-validated alias first, then at the original name (RFC 7672 2.2.2). Before, such domains wrongly got NOTFOUND. (#1)
• Only usable TLSA counts (usage 2/3, selector 0/1, matching type 0/1/2). A host with only unusable records no longer gets dane-only, which would have made it unreachable.
• Unix socket + dedicated user by default: /var/run/postfix_dane_policy/policy.sock in a danepolicy:postfix 0750 directory, root-owned supervisor pidfile. (#2)
• Limits: max connections, request deadline (no slowloris), max 10 MX hosts, total lookup budget, merged concurrent lookups, non-loopback listen needs --allow-remote. (#3)
• Strict keys: IDNA 2008/UTS#46 to A-labels, invalid names are NOTFOUND, no log injection. (#4)
• Resolver self-test: if the resolver doesn't validate DNSSEC, every lookup answers TEMP. dnspython >= 2.6.1, idna, LRU cache, CI actions pinned by SHA, distinfo verified against the release tarball. (#5)
• Docs: tls_required_enable = no, CA trust store, smtp_tls_mandatory_protocols.

Upgrading from 0.2.x: a TCP setup keeps working. To switch, create the user (the port does it), drop the TCP args and point Postfix to socketmap:unix:/var/run/postfix_dane_policy/policy.sock:dane. See README.