Add optional OpenNIC root support (OPENNIC=1)

[zquestz]

Setting OPENNIC=1 on the container makes Unbound resolve from the OpenNIC
root instead of the ICANN root. Without the variable, nothing changes.

In OpenNIC mode, the generated config uses root-hints: "opennic.hints" and
auto-trust-anchor-file: "var/opennic.key" (seeded from the baked-in OpenNIC
KSK, then maintained via RFC 5011). The internic auth-zone and the
unbound-anchor call are skipped. The OpenNIC root carries the DS records of
the ICANN TLDs, so validation of the regular namespace is unaffected.

entrypoint.sh change: /etc/runit/2 execs env -, so service scripts never
see container env vars. start() writes the value to /etc/opennic-env and
unbound.sh reads it as a fallback.

The hints and KSK (key tag 60820) were fetched from two independent OpenNIC
servers over DoH and match the anchor published on the OpenNIC wiki. Refresh
instructions are in the README.

Tested: unbound-checkconf clean in both modes, default-mode config
unchanged. Deployed live behind dnscrypt-proxy: grep.geek resolves, and
com. SOA returns the ad flag through the OpenNIC anchor.

Let me know if there is anything you want me to adjust or improve. =)

[zquestz]

@jedisct1 any interest in this PR?

[jedisct1]

Looks really good, thanks!

One small thing: in the original script, unbound-anchor only ran if the mkdir and chown of var/ had succeeded.

But with the change, the chain stops at the chown, so the anchor setup now runs even if creating the directory failed.

Ok, this is probably harmless in practice, but I'd prefer to keep the old guarantee :)

[zquestz]

Good catch, fixed. The anchor setup (both modes) is now the third link of the mkdir/chown chain again, and the OpenNIC branch also gates its chown on the cp succeeding.

I also tested this in my infra, the new code is up and resolving. =)

[jedisct1]

Thank you!