dns/bind: add validate-except config option for split dns on forward zones

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.
When running a split-horizon DNS setup where the public domain is DNSSEC-signed, internal clients experience SERVFAIL errors when querying internal, unsigned forward zones. While BIND implicitly trusts local primary zones and bypasses validation for them, forwarded zones trigger strict recursive checks. BIND attempts to validate the forwarded zone against the public chain of trust and naturally fails.

Currently, the BIND plugin UI does not expose the validate-except directive, making it impossible to exclude these internal zones/subdomains from DNSSEC validation without manual backend workarounds that get overwritten by the template engine.

Describe the solution you'd like
Add a config option to the plugins general configuration page. I'll file a PR on the change.

Describe alternatives you've considered
None.

Additional context
None.

Start by inspecting the BIND plugin's general configuration page and the template handling that generates its configuration. Trace how existing DNS options reach the generated configuration, then verify that a configurable validate-except option is exposed and supports internal forward zones without being overwritten.