dns: better cname checks
Need to implement more/better checking for CNAME records to prevent invalid records. Eg. not long ago someone reported an issue which was caused by creating CAA records for a hostname which had a CNAME records. Just now I created a CNAME record for a hostname which already had a TXT record, which is invalid. We should look up the exact set of what is allowed to be present with CNAME and only allow those.