fix: usr: Resolver could return expired records instead of a negative answer

When an unvalidated negative answer (such as one obtained for
a query with the "checking disabled" flag set) arrived for
a name that had DNSSEC-validated records in the cache, those
records blocked the negative answer from being cached even
after they had passed their TTL, and the expired records could
be returned to the client instead. Validated records that have
expired no longer prevent negative answers from being cached.

Merge branch '5877-skip-inactive-headers' into 'main'

See merge request isc-projects/bind9!12423