Mitigate YXDOMAIN and nodata non-referral answer poisoning.

Add a fix to apply scrubbing of unsolicited NS RRSets (and their
respective address records) for YXDOMAIN and nodata non-referral
answers. This prevents a malicious actor from exploiting a possible
cache poison attack.

Obtained from: NLnet Labs
Security: CVE-2025-11411