bind: Update to 9.16.35

bind: Update to 9.16.35

For details for 9.16.35 and 9.16.34 (we skipped the last) see:
https://downloads.isc.org/isc/bind9/9.16.35/doc/arm/html/notes.html#notes-for-bind-9-16-35

"Notes for BIND 9.16.35
Bug Fixes

    A crash was fixed that happened when a dnssec-policy zone that used
    NSEC3 was reconfigured to enable inline-signing. [GL #3591]

    In certain resolution scenarios, quotas could be erroneously reached
    for servers, including any configured forwarders, resulting in SERVFAIL
    answers being sent to clients. This has been fixed. [GL #3598]

    rpz-ip rules in response-policy zones could be ineffective in some
    cases if a query had the CD (Checking Disabled) bit set to 1. This has
    been fixed. [GL #3247]

    Previously, if Internet connectivity issues were experienced during the
    initial startup of named, a BIND resolver with dnssec-validation set to
    auto could enter into a state where it would not recover without
    stopping named, manually deleting the managed-keys.bind and
    managed-keys.bind.jnl files, and starting named again. This has been
    fixed. [GL #2895]

    The statistics counter representing the current number of clients
    awaiting recursive resolution results (RecursClients) could overflow in
    certain resolution scenarios. This has been fixed. [GL #3584]

    Previously, BIND failed to start on Solaris-based systems with hundreds
    of CPUs. This has been fixed. [GL #3563]

    When a DNS resource record’s TTL value was equal to the resolver’s
    configured prefetch “eligibility” value, the record was erroneously not
    treated as eligible for prefetching. This has been fixed. [GL #3603]

...

Notes for BIND 9.16.34

Bug Fixes

    Changing just the TSIG key names for primaries in catalog zones’ member
    zones was not effective. This has been fixed. [GL #3557]"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>