feat(api): for new domains, set "NSEC3PARAM 1 0 0 -"

We don't need a salt because the apex name is part of the hash, serving
as salt (global rainbow tables not possible).

The iteration count means "extra iterations", i.e. 0 means hashing once.
Values above 10 are no longer recommended. The factor of 10 is not
significant for an attacker, but incurs unnecessary load on the primary
and resolvers. Still, the single iteration keeps away casual attacks.

Reference: https://datatracker.ietf.org/doc/html/draft-hardaker-dnsop-nsec3-guidance

api/desecapi/pdns_change_tracker.py

@@ -1,4 +1,3 @@
-import secrets
 import socket
 
 from django.conf import settings
@@ -84,14 +83,13 @@ class PDNSChangeTracker:
             return True
 
         def pdns_do(self):
-            salt = secrets.token_hex(nbytes=8)
             _pdns_post(
                 NSLORD, '/zones?rrsets=false',
                 {
                     'name': self.domain_name_normalized,
                     'kind': 'MASTER',
                     'dnssec': True,
-                    'nsec3param': '1 0 127 %s' % salt,
+                    'nsec3param': '1 0 0 -',
                     'nameservers': settings.DEFAULT_NS,
                     'rrsets': [{
                         'name': self.domain_name_normalized,