Fixes#2268.
RFC 6598 section 4 says reverse queries for 100.64.0.0/10 MUST NOT be
forwarded to the global DNS, but only the RFC 6761 private reverse zones were
answered locally. Map 64.100.in-addr.arpa through 127.100.in-addr.arpa to
NXDOMAIN alongside them.
With dnssec.validate enabled this also turns the SERVFAIL clients got for
these names back into NXDOMAIN: upstreams filter the query per the same
section and answer with an unsigned NXDOMAIN under the signed
100.in-addr.arpa zone, which fails validation.
Co-authored-by: Dimitri Herzog <[email protected]>
