Merge upstream r4302 to support multiple concurrently valid anchors.

If an unpatched unbound-anchor is run without a preexisting root anchor
between 2017-09-11 and 2017-10-11, it will fail and Unbound will not be
able to start unless the validator is disabled. An EN will be issued
with patches for existing systems and information on how to work around
the issue on new installations.