If SNIKKET_DNS_CHALLENGE is set to 1, or SNIKKET_TWEAK_XMPP_DOMAIN is
set, spin up an instance of CoreDNS to respond to DNS challenges. Shut
it down once certificates are obtained, and only enable it on renewal.

Rationale
"Many DNS servers do not provide an API to enable automation for the
ACME DNS challenges. Those which do, give the keys way too much power.
Leaving the keys laying around your random boxes is too often a
requirement to have a meaningful process automation."
See https://github.com/joohoi/acme-dns

Requirements (domain.tld is SNIKKET_TWEAK_XMPP_DOMAIN or SNIKKET_DOMAIN
if not set)
 - The CNAME record of _acme-challenge.domain.tld needs to point to
   cert.snikket.domain.tld
 - The NS record of snikket.domain.tld needs to point to
   ns-snikket.domain.tld
 - The A/AAAA record(s) of ns-snikket.domain.tld needs(s) to point to
   the instance IP address

Mechanics
 - Through a certbot pre-hook, the requirements are first validated
   (although a failure is only logged). Next, a CoreDNS instance is spun
   up with just SOA and NS records for snikket.domain.tld, with the NS
   set to ns-snikket.domain.tld
 - Using certbot's manual plugin + its authorization hook, the relevant
   TXT record is added to cert.snikket.domain.tld. Multiple records are
   supported here, so this script can be used for domain.tld and
   *.domain.tld in one go.
 - Through a certbot post-hook, the DNS server is shut down after
   certificates are obtained.

Considerations
 - Since it is possible that people are hosting their instance on
   snikket.domain.tld, an override for the DNS ZONE can be added.
   Alternatively, we can keep the DNS server running, but that will add
   much more complexity to the setup.

 - Add wait time between DNS server creation and NS record check
 - Add logs to indicate if DNS challenge is being used, and why
 - Add logs to indicate wait time and completion
 - Add style file and pre-commit hook (activate with `git config
   --local core.hooksPath .githooks`)

To prevent `assert( token )` from failing for persistent volumes
(certificate renewal or other option changes), remove the file each time
the pre-hook is run.