Introduce a /private/replace_ds private API endpoint
This is going to be used by opendnssec scripts to push ds records for a child zone.