Providing DNSSEC trust anchors for VerifyHostKeyDNS

[Skye Soss]

When OpenSSH is built with ldns support, the VerifyHostKeyDNS=yes option will cause `ssh` to look up an SSHFP
resource record, also asking for DNSSEC records. If the resolver sets the AD bit, `ssh` will trust the response.
If not, `ssh` will "try autonomous validation" (getrrsetbyname-ldns.c:152), asking ldns library to perform the
DNSSEC validation.

The issue is that ldns will only look for DNSSEC trust anchors that are listed as `anchor <file>` in /etc/resolv.conf.
Such an option is not standard, and maintaining the setting is even more challenging due to lack of support in
resolvconf and systemd-resolved.

The solution that `drill` uses is to set a default DNSSEC trust anchor file path at compile-time (LDNS_TRUST_ANCHOR_FILE).
I think the same kind of setting would work well for OpenSSH.
Another option would be to have an ssh_config option like DNSSECTrustAnchorFile=, and to load those files into ldns.

I'd be willing to send a patch (or create a GitHub PR) if this is a feature that would be accepted.

Skye