Mitigate YXDOMAIN and nodata non-referral answer poisoning.

Add a fix to apply scrubbing of unsolicited NS RRSets (and their
respective address records) for YXDOMAIN and nodata non-referral
answers. This prevents a malicious actor from exploiting a possible
cache poison attack.

Obtained from: NLnet Labs
Security: FreeBSD-SA-25:10.unbound
Security: CVE-2025-11411

(cherry picked from commit 2a3a6a1771148a709c2d9694c1d66c41ce8dee79)