Recursive CNAME aliases are hard to make work correctly, and failure modes are severe

### Prerequisites

- [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a) and found no answer

- [X] I have searched other issues and found no duplicates

- [X] I want to report a bug and not [ask a question or ask for help](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a)

- [X] I have set up AdGuard Home correctly and [configured clients to use it](https://github.com/AdguardTeam/AdGuardHome/wiki/Clients). (Use the [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a) for help with installing and configuring clients.)

### Platform (OS and CPU architecture)

Linux, AMD64 (aka x86_64)

### Installation

Custom package (OpenWrt, HomeAssistant, etc; please mention in the description): NixOS package

### Setup

On a router, DHCP is handled by the router

### AdGuard Home version

0.107.36

### Action

I want to have AdGuardHome `user_rules` to resolve CNAME aliases, where these CNAME names are themselves defined by `user_rules`. For example:

```
user_rules:
- '||r0.lan^$dnsrewrite=NOERROR;A;192.168.1.1'
- '||adguard.lan^$dnsrewrite=NOERROR;CNAME;r0.lan'
```

At this point in configuration:

```
$ dig @127.0.0.1 r0.lan
<...>
;; ANSWER SECTION:
r0.lan. 10 IN A 192.168.1.1
<...>

$ dig @127.0.0.1 adguard.lan
<...>
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 25499
<...>
```

In a previous issue on this topic (https://github.com/AdguardTeam/AdGuardHome/issues/4057) it was suggested that I point `adguardhome` to itself to resolve `lan` domains:

```
upstream_dns:
- 9.9.9.9
- '[/lan/]127.0.0.1'
```

At this point, we indeed get a working response when querying `adguard.lan`.

However, today a new machine was introduced into my network. And I started experiencing the DNS server going down at consistent intervals. It turns out that this machine is making queries for `foo.corp.lan` – a domain, which I’ve not written in my `user_rules`. This then makes `adguardhome` go into a loop where it receives a query for `foo.corp.lan`, does not find any `user_rules` for it and then consults the upstream DNS servers (self!) for how to resolve `foo.corp.lan`. While it is doing so, it seems that it will *not* accept any other queries either (which is not a great failure mode, but it also at least serves to make the issue painful enough to warrant investigating it.)

### Expected result

It should be easier to configure this sort of set-up. I would expect an immediate NXDOMAIN and/or log message for configuration mistakes like these.

### Actual result

The concept behind a manual set-up makes sense, but many kinds of mistakes can easily lead into an infinite resolve recursion, which in turn decapitates the DNS resolver for other clients. Examples of mistakes I think are plausible:

### Self recursive rules

```
upstream_dns:
- 9.9.9.9
- '[/lan/]127.0.0.1'
user_rules:
- '||r0.lan^$dnsrewrite=NOERROR;CNAME;r1.lan'
- '||r1.lan^$dnsrewrite=NOERROR;CNAME;r0.lan'
```

When querying `r0.lan` adguardhome will recurse to self to find out that it needs to query `r1.lan` which will recurse to self to query `r0.lan`… such a self-recursive rewrite should `NXDOMAIN` at the first or second query, rather than spending 20 seconds sending queries to itself.

### Missing catch-all statement

```
upstream_dns:
- 9.9.9.9
- '[/lan/]127.0.0.1'
user_rules:
- '||r0.lan^$dnsrewrite=NOERROR;A;123.123.123.123'
```

Here if I query `r2.lan`, adguardhome will notice that it has no user_rules for this, and query… itself immediately.

### Additional information and/or screenshots

I’m planning on experimenting with adding a catch-all user_rule that replies `NXDOMAIN` to any `*.lan` queries that have not been configured here, but first and foremost I've no clue as to what is the order in which these rules are applied, and I'm not confident I can get this right from the get go.

(Not to mention that my configuration is combined from multiple sources, and I don't have full control of the order in which the `user_rules` appear…)