SERVFAIL handling with --all-servers

Currently with `--all-servers` enabled, it seems like the fastest response is forwarded, even if that happens to be a `SERVFAIL`, which is pretty bad for some use cases. A `SERVFAIL` can indicate network problems, e.g. some DNS servers/proxies answer very quickly with `SERVFAIL`, when their own upstream is dead (which I guess is correct and reasonable), in this case `--all-servers` makes things even worse than using just a single server, because now if any upstream is dead, we're always failing.

I suggest changing `SERVFAIL` handling to by default only forward it, if all upstream servers happen to respond with `SERVFAIL`.

In case someone brings DNSSEC as argument, maybe `SERVFAIL`s can optionally be forwarded immediately, if coming with an appropriate EDE error code (RFC 8914).

(The `SERVFAIL` handling in fallback mode might be related: https://github.com/AdguardTeam/dnsproxy/issues/257)