Deprecate SHA-1 in dnssec-dsfromkey

This makes the `-12a` options to `dnssec-dsfromkey` work more like
`dnssec-cds`, in that you can specify more than one digest and you
will get multiple records. (Previously you could only get one
non-default digest type at a time.)

The default is now `-2`. You can get the old behaviour with `-12`.

Tests and tools that use `dnssec-dsfromkey` have been updated to use
`-12` where necessary.

This is for conformance with the DS/CDS algorithm requirements in
https://tools.ietf.org/html/draft-ietf-dnsop-algorithm-update

bin/python/isc/checkds.py.in

@@ -115,7 +115,7 @@ def check(zone, args):
     klist = []
 
     if args.masterfile:
-        cmd = [args.dsfromkey, "-f", args.masterfile]
+        cmd = [args.dsfromkey, "-12f", args.masterfile]
         if args.lookaside:
             cmd += ["-l", args.lookaside]
         cmd.append(zone)
@@ -123,7 +123,7 @@ def check(zone, args):
     else:
         intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
                            "-q", zone], stdout=PIPE).communicate()
-        cmd = [args.dsfromkey, "-f", "-"]
+        cmd = [args.dsfromkey, "-12f", "-"]
         if args.lookaside:
             cmd += ["-l", args.lookaside]
         cmd.append(zone)