This creates a new class to represent a TSIG key, containing name,
secret, and algorithm.

The keyring format is changed to be {name : key}, and the methods in
dns.tsigkeyring are updated to deal with old and new formats.

The Message class is updated to use dns.tsig.Key, although (to avoid
breaking existing code), it stores them in the keyring field.

Message.use_tsig() can accept either explicit keys, or keyrings; it will
extract and/or create a key.

dns.message.from_wire() can accept either a key or a keyring in the
keyring parameter.  If passed a key, it will now raise if the TSIG
record in the message was signed with a different key.  If passed a
keyring containing keys (as opposed to bare secrets), it will check that
the TSIG record's algorithm matches that of the key.

* Create an OPT record class.

* Move OPT logic to one place.

* Store the OPT record on the message object.

This also adds a Renderer.add_rdata() method.

* Add Rdataset.rdata_to_wire() helper.

* Fix conflicts; simplify.

* Fix typo.

* style

* Add a trivial to_text so that repr() works.

* Add _parse_special_rr_header

* More OPT checking.

Pass the name to _parse_rr_header and _parse_special_rr_header, and
check that the OPT record has the root name.

There's no need to attach an attribute to the _TextReader/_WireReader
classes; the code has access to the message.

Instead of validating rrsets and sections after parsing them, check the
class/type for each record before parsing it.  This is more generic,
because it moves all of the update logic out of the common code.  It's
also more flexible, as it allows the update logic to specify that
meta-records are empty.