DNS-01 authenticator that walks up the labels of the validation name,
calls findzone on the dns-server RPC to locate the registered parent
zone, then addrecord/deleterecord around the TXT challenge.
Auth is HTTP Basic with the shared rpc key (matches the protocol the
yeil DNS web app uses in dns/src/lib/rpc.ts).
