Publish a DNS-01 challenge value with the API key

Publishes the TXT value at _acme-challenge.HOSTNAME directly, authenticated by the API key rather than by a minted acme-dns credential. Same authorization as minting a credential (dns01:write, narrowed to the hostname if the key is), same two-newest rule and TTL on the record, and the same per-hostname rate budget as /acme/update. This is the path for a client that keeps no state: a credential's password is shown once and capped at five per hostname, so minting one per run would exhaust it.