Update to upstream version '1.16.2'
with Debian dir f9dce9e015149f86316f5bda836b99a6e5571375

- Merge #718: Introduce infra-cache-max-rtt option to config max
  retransmit timeout.

Introduce infra-cache-max-rtt option to config max retransmit timeout

Added the option and let it default to 120 seconds so that it won't change
current behavior.

Related-to #717

  And fixup the lock code.

Avoid treat normal hosts as unresponsive servers

This is a fix for issue #713

When infra-keep-probing is on, all hosts with expired entries were treated as
unresponsive servers and thus causing problems (see #713).

This commit change that, so that normal hosts with expired entries are treated
as unknown servers.

  equivalent (IPV6_USER_MTU); allows cross compiling with latest
  cross-compiler versions.

 add SECURITY.md, based on krill

  The code repo continues with version 1.16.2 under development.

d/tests: run with unconfined apparmor profile

See merge request !20

Run unbound with an unconfined apparmor profile while running the DEP8
tests to allow usage of configuration and pid files in the autopkgtest
temporary directory.

Merge branch 'IP_BIND_ADDRESS_NO_PORT' of https://github.com/crrodriguez/unbound into crrodriguez-IP_BIND_ADDRESS_NO_PORT

  one loop pass'.

  val_sigcrypt.c::dnskeyset_verify_rrset_sig.

  the openssl trust store.

- Merge PR #660 from Petr Menšík: Sha1 runtime insecure.

Sha1 runtime insecure

- Merge PR #671 from Petr Menšík: Disable ED25519 and ED448 in FIPS
  mode on openssl3.

NXNS fallback