new: usr: Disclose active Negative Trust Anchors with Extended DNS Error 33

A Negative Trust Anchor (RFC 7646) turns off DNSSEC validation for a domain,
so a name that would normally fail validation resolves instead. named now
marks such answers with Extended DNS Error code 33, "Negative Trust Anchor",
so operators can see at a glance when a response came back only because
an NTA was in effect.

Closes #6268

Merge branch '6268-implement-nta-ede' into 'main'

See merge request isc-projects/bind9!12424