[CVE-2026-11331] sec: usr: Fix handling of rpz CNAME expansion that returns name...

[CVE-2026-11331] sec: usr: Fix handling of rpz CNAME expansion that returns name too long

Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self referential CNAME and the original address record were returned, allowing the policy to be bypassed.  In branches up to 9.20, this also left query processing in an inconsistent state which could trigger an assertion failure.  We now return a YXDOMAIN response, without the address.

ISC would like to thank Laith Mash'al (0xmshal) for bringing this issue to our attention.

Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5856

Merge branch '5856-confidential-rpz-cname-nametoolong' into 'security-main'

See merge request isc-private/bind9!984