Fall back to non-EDNS queries on FORMERR

[lattwood]

What

ZDNS always adds an EDNS OPT record to queries. Some authoritative servers return FORMERR when EDNS is present but answer the same query normally without it.

If we get FORMERR without an OPT record in the response, retry the same nameserver without EDNS.

There are a few guardrails:

• Don’t fall back when DNSSEC is enabled.
• Don’t fall back when explicit EDNS options were requested.
• Don’t fall back when the FORMERR response contains OPT—the server understood EDNS in that case.
• Give the fallback its own rate-limit admission and network timeout.
• Don’t cache EDNS support, since that can leave long-running resolvers stuck with stale capability state.

This applies to UDP, TCP, DoT, and DoH, and leaves the existing UDP-to-TCP truncation behavior alone.

Testing

Added coverage for:

• UDP and TCP fallback.
• FORMERR responses with and without OPT.
• DNSSEC and explicit EDNS options.
• Rate-limit admission for both attempts.
• A delayed FORMERR followed by a delayed successful response through ExternalLookup, verifying that both wire operations get a full NetworkTimeout.

Also ran:

• go test ./...
• Focused tests under the race detector.
• golangci-lint run ./...
• The original query against the Microsoft authoritative server.

Fixes #617