Make explicit the fact that `query_cname()` and `query_dname()` must be
called only from a context where the resolver is answering a question
which is _not_ respectively `CNAME` or `DNAME`.
Merge branch 'colin/explicit-dname-cname-libns-query-usage' into 'security-main'