respond with servfail if dnssec validation fails

security-aware resolvers like hsd should protect users from forged DNSSEC responses. hsd only omits the "AD" flag from the response but it should return SERVFAIL instead.

example:

`dig @1.1.1.1 dnssec-failed.org a`

this will return SERVFAIL with 1.1.1.1 but hsd will return an A record

Start by reproducing the issue with `dig @1.1.1.1 dnssec-failed.org a`, then trace hsd's DNSSEC validation and response-generation path. Done means a DNSSEC validation failure produces a SERVFAIL response rather than an A record without the AD flag.

Written by the indexing model from the issue text.