add new DNSSEC trust-anchor

https://github.com/infinet/dnsmasq/issues/16

google and other gfwed domains shall use special server only. There is a bug
that let dnsmasq use default server for special domain lookup.

change from --address=/malware.com/# to --address=/malware.com/

add a new option for blocking malware site

1. choose shift-and-xor hash because it does not use multiply and is
   faster than bernstain during profiling
2. better boundary check for normalize_domain_name
3. change hash table % to bit &

variable for IPV6 was ignored until test build a full feature debian package
found the problem.

--server without ip address means the domain is local and the query should not
be forwarded to upstream servers