Add SSHFP and TLSA record types (RFC 4255 / RFC 6698 DANE)

[joyider]

Part of Feature breadth / record-type coverage in the Enterprise DNS Roadmap.

Add authoritative support for two more record types by mirroring the existing rtype plugin pattern in zone/rtypes/ (see caa.go / srv.go and the Register() registry in rtypes.go). miekg/dns already parses both wire and presentation formats, so the work is mostly storing, serving, and serializing the rdata plus tests.

SSHFP (RFC 4255)

• Fields: algorithm (uint8), fingerprint type (uint8), fingerprint (hex).
• Low effort; good first issue.

TLSA (RFC 6698 — DANE)

• Fields: usage, selector, matching type, certificate association data.
• Natural partner to the existing DNSSEC support (DANE relies on a signed zone to be trustworthy).

Scope

• zone/rtypes/sshfp.go + _test.go, registered via Register()
• zone/rtypes/tlsa.go + _test.go, registered via Register()
• API create/list/delete works through the generic record routes
• AXFR/IXFR carries the new types
• DNSSEC signing covers the new RRsets (RRSIG, NSEC/NSEC3 bitmap)
• OpenAPI / docs note the supported types

Suggested as two separate PRs (one per type) to keep review small.