secondary: if signed notify with a soa is received, do a axfr (or nothing) directly
secondary: support for no soa yet, request axfr (if signed notify and key == root zone)
primary: send notify if key == root zone connected (with all available zones)
mirage-server: reworked to initialise tcp connections in primary
drop destination ports in server, the primary + secondary are always on 53 (or hidden primary, then its an ip and doesn't matter) -- limitation is now one connection per ip ;)
that should allow more dynamic secondaries :) and kill some round trips (notify -> soa -> axfr) which is annoying for sleep-less let's encrypt
need to review, cleanup and write some test cases... but this should work...