dns/bind: add DNS-over-TLS forwarder support and sync DNSBL from Unbound

Start with the existing BIND plugin GUI and legacy forwarder configuration, then trace the Unbound XML model and blocklists.conf template; named.conf is the current manual-edit workaround. Done means the GUI supports plain and DoT forwarders with migration, DNSBL data stays synchronized with Unbound, and records have their own tab with corrected column sizing.

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.
BIND 9.20 supports native DNS-over-TLS forwarders (Strict per RFC 9103 and Opportunistic), but the BIND plugin GUI has no way to configure them — there is no field for a TLS hostname or per-forwarder destination port.

The DNSBL blocklists hasn't been updated since 2018, while Unbound's equivalent lists are actively maintained.

Additionally, the primary zones and records grids share a tab, causing the bottom table to collapse instead of honoring its row count.

Describe the solution you'd like

• A "DNS Forwarders" tab with grids for plain forwarders (ip + port) and DoT forwarders (ip + port + TLS hostname), with Strict TLS when a hostname is set and Opportunistic otherwise. Legacy forwarders should migrate automatically.
• DNSBL blocklists sourced dynamically from Unbound's XML model and blocklists.conf template at runtime, replacing the hardcoded shell fetcher with a Python implementation that stays in sync without separate maintenance.
• Records moved to a dedicated tab, and column widths adjusted so long zone names don't wrap.

Describe alternatives you've considered
Unbound does support DoT, but it is not an authoritative domain server service. A workaround of manually editing BIND's named.conf is possible but not accessible from the GUI.

Maintaining the DNSBL lists manually in the BIND plugin was considered, however it was noted that the plugin is not updated regularly enough to keep the lists current. Mirroring Unbound's lists requires maintinance.