- Merge #1090: Cookie secret file. Adds
  `cookie-secret-file: "unbound_cookiesecrets.txt"` option to store
  cookie secrets for EDNS COOKIE secret rollover. The remote control
  add_cookie_secret, activate_cookie_secret and drop_cookie_secret
  commands can be used for rollover, the command print_cookie_secrets
  shows the values in use.

* nlnet/master: (66 commits)
  - Tag for release 1.21.0, the repository continues with 1.21.1   in development.
  - Fix spelling for the cache-min-negative-ttl entry in the   example.conf.
  - Fix that for windows the module startup is called and sets up   the module-config.
  - Set version number to 1.21.0 for release.
  - Fix CacheFlush issues with limit on NS RRs. Thanks to Yehuda Afek,   Anat Bremler-Barr, Shoham Danino and Yuval Shavitt (Tel-Aviv   University and Reichman University).
  - Fix CAMP issues with global quota. Thanks to Huayi Duan, Marco   Bearzi, Jodok Vieli, and Cagin Tanir from NetSec group, ETH Zurich.
  - Fix that alloc stats for forwards and hints are printed, and when   alloc stats is enabled, the unit test for unbound control waits for   reloads to complete.
  Changelog note for NLnetLabs#1090 - Merge NLnetLabs#1090: Cookie secret file. Adds   `cookie-secret-file: "unbound_cookiesecrets.txt"` option to store   cookie secrets for EDNS COOKIE secret rollover. The remote control   add_cookie_secret, activate_cookie_secret and drop_cookie_secret   commands can be used for rollover, the command print_cookie_secrets   shows the values in use.
  Cookie secret file (NLnetLabs#1090)
  Update changelog. - Fix testbound for alloc stats strdup in util/alloc.c.
  - Fix testbound for alloc stats strdup in util/alloc.c.
  - Fix that alloc stats has strdup checks, it stops debuggers from   complaining about mismatch at free time.
  - Fix that the worker mem report with alloc stats does not attempt   to print memory use of forwards and hints if they have been   deleted already.
  - Fix dnstap test program, cleans up to have clean memory on exit,   for tap_data_free, does not delete NULL items. Also it does not try   to free the tail, specifically in the free of the list since that   picked up the next item in the list for its loop causing invalid   free. Added internal unit test to unbound-dnstap-socket for that.
  - Fix for NLnetLabs#1114: Fix that cache fill for forward-host names is   performed, so that with nonzero target-fetch-policy it fetches   forwarder addresses and uses them from cache. Also updated that   delegation point cache fill routines use CDflag for AAAA message   lookups, so that its negative lookup stops a recursion since the   cache uses the bit for disambiguation for dns64 but the recursion   uses CDflag for the AAAA target lookups, so the check correctly   stops a useless recursion by its cache lookup.
  - Fix to document parameters of auth_zone_verify_zonemd_with_key.
  - Add root key 38696 from 2024 for DNSSEC validation. It is added   to the default root keys in unbound-anchor. The content can be   inspected with `unbound-anchor -l`.
  - For NLnetLabs#935 and NLnetLabs#1104, clarify RPZ order and semantics.
  - Cleanup ede.tdir test.
  - Fix link of unbound-dnstap-socket without openssl.
  ...