Fix for correct openssl error when adding windows CA certificates to the openssl trust store.For #660: formatting, less verbose logging, add EDE information.Merge PR #660 from Petr Menšík: Sha1 runtime insecure.Merge PR #671 from Petr Menšík: Disable ED25519 and ED448 in FIPS mode on openssl3.From #706: When a lame address is the best choice, don't try to generate target queries when the missing targets are all lame.From #706: Don't generate parent side queries if we already have the lame records in cache.From #706: Cached NXDOMAIN does not increase the target nx responses.Fix compile warning for windows compile.Fix detection of libz on windows compile with static option.

This will also allow MAX_TARGET_NX more NXDOMAINs. Allow fallback to the parent side when MAX_TARGET_NX is reached.Fix to not count cached NXDOMAIN for MAX_TARGET_NX.Add debug option to the mini_tdir.sh test code.Fix for cached 0 TTL records to not trigger prefetching when serve-expired-client-timeout is set.Fix test program dohclient close to use portability routine.Fix #663: use after free issue with edns options.Fix for loading locally stored zones that have lines with blanks or blanks and comments.Remove unused LDNS function check for GOST Engine unloading.

Note in the nf text that NOTIFY is allowed from the 'url:' addresses for auth and rpz zones.

Fix for edns client subnet to respect not looking in its cache when instructed to do so (e.g., prefetch).

makedist.sh picks up 32bit libssp-0.dll when 32bit compile.

Opendns dnscrypt pfsense 2.4