resolved: refuse queries with no suitable scope

resolved: refuse queries with no suitable scope

In some cases there is no configured server to answer a given question,
because all scopes refused the query. In this case we currently return
rcode SERVFAIL.

In dns it is customary for authoritative nameservers to return REFUSED
where the question is outside of their authority. This is better than
SERVFAIL because it informs the client that they aren't likely to get an
answer out of us anytime soon, and either the configuration, or the
query, need to change.

Similar logic invites us to use use the rcode REFUSED on the stub if we
aren't configured with any suitable scope for this question.