Log the query name, and correct the docs now Rust is the default

[andylemin]

Follow-up to #5, from running the Rust daemon on a live firewall.

Log lines named the addresses but not the answer

Two log lines reported IPs and TTLs without saying which query they belonged
to, which is the part an operator recognises. A TTL is also unreadable without
the kind: seconds remaining under rr, an absolute expiry under cache.

PF Table updated for www.bing.com. (rr): AF4 23.55.129.60=300 AF6 none
TTL expired from pfui_ipv4_domains: 23.55.129.60 (www.bing.com.)

The expiry line costs nothing to produce: qname is already in the Redis hash
the scan reads, so expired_keys now returns it alongside the address.

The _pfui group left the reader unsure whose job it was

The unix-socket config example named SOCKET_UNIX_GROUP: _pfui with no
indication of whether installing it was manual. It is not, provided the
firewall is installed first: the server installer creates the group and adds
_pfui_firewall, and the client installer adds _unbound when it finds the
group already present. Install the resolver first and that second step is
silently skipped, so the README now says so and gives the manual command.
Unbound must restart before a new membership takes effect.

Documentation still described a Python-only firewall

Python is optional on the firewall now. The component summary, the
compatibility note and the shebang entry under Known Issues are each scoped
to the daemon they apply to, and the chroot caveat is the resolver's rather
than the firewall's. The server-rust row and its README also drop the
pending-validation wording, since that validation is done.

Testing

• 124 Rust tests, cargo fmt --check and clippy -D warnings clean
• 219 Python tests, 30 C vector checks, bash -n and ksh -n on every script
• Log formats confirmed by running the release daemon and sending messages
  with a present qname, an absent one, and both rr and cache

Follow-ups

• pledge(2), which waits on the unpledged OpenBSD pass being repeated with it on
• reducing the resolver module's external dependencies to lz4 alone