(refactor) TrustAnchor should be a non-empty list

[japaric]

TrustAnchor should have the invariant of being non-empty. That way Client::delv does not have to check that its TrustAnchor argument is not empty.

IOW, the TrustAnchor constructor must take an initial key

impl TrustAnchor {
    // pub fn empty() -> Self; // removed
    pub fn new(key: DNSKEY) -> Self { /* .. */ }
}