[Feat] Unbound: Refresh local-zone ipset entry TTL on subsequent queries with matching IPs in RRSet

[EngineersBox]

Background

• DNS servers can reuse the IPs for domains, e.g., 1.2.3.4 => 4.3.2.1, and then back to 1.2.3.4 after
• Unbound only creates a fresh ipset rule, it doesn't refresh existing entries' TTL
• We can have a case where ipset entry's TTL is about to expire, but then the DNS server switched to that IP again. We will have a period where we have an address missing from the ipset for that domain until the DNS entry expires

See this table for example

timestamp	ipset entry	DNS entry
0	1.2.3.4 TTL 3	1.2.3.4 TTL 60
3	-	1.2.3.4 TTL 57

This means worst case scenario is DNS TTL - ipset TTL of no ipset entry presence. In the worst case scenario a 60 second RRSet entry (for example) could have an ipset entry present for only 1 second if the query finishes on the last second that the ipset contains the ip.

Note that bumping ipset TTL value itself might help reducing the occurrences, but not going to fully eliminate the problem

Solution

To make non-overlapping DNS cycles more palatable, Unbound can refresh/reset the TTL of an ipset set instead of leaving it at the current value. This applies when a DNS query responds with an IP that matches an existing ipset entry that was stored as a result of a previous DNS query

Notes

A follow up PR for a more comprehensive rework of ipset support has been raised here: #1335