resolver: dnssec and cd bit in query

[hannesm]

Properly handle if a client requested "checking disabled" and return invalid / unchecked resource records. The tricky bit is that our dns_cache contains only validated entries (thus we'll need to establish another cache)...