Up till now we would only chase 1 CNAME. Spec requires we will chase
all. This PR add support for this.  Up to 8 CNAMEs are chased (this
could be longer, by just checking for cycles, but 8 seems enough for
now).

Also add RRSIG of the first CNAME for DNSSEC.