fix: doc: Correct RPZ NSDNAME name-order precedence documentation

The ARM incorrectly stated that the canonically smallest
matched name server wins when multiple NSDNAME triggers
have otherwise equal precedence. BIND intentionally selects
the name appearing last in DNSSEC canonical order, as specified
by RPZ. The ARM and source comment have been corrected to describe
the existing behavior; runtime behavior is unchanged.

Closes #6348

Merge branch '6348-fix-rpz-nsdname-precedence-documentation' into 'main'

See merge request isc-projects/bind9!12590