Add tests for forwarder cache poisoning scenarios

Add tests for forwarder cache poisoning scenarios

- Check that an NS in an authority section returned from a forwarder
  which is above the name in a configured "forward first" or "forward
  only" zone (i.e., net/NS in a response from a forwarder configured for
  local.net) is not cached.
- Test that a DNAME for a parent domain will not be cached when sent
  in a response from a forwarder configured to answer for a child.
- Check that glue is rejected if its name falls below that of zone
  configured locally.
- Check that an extra out-of-bailiwick data in the answer section is
  not cached (this was already working correctly, but was not explicitly
  tested before).

- v9_11 backport: Revert primary/secondary to master/slave,
  backport rndc helper, backport ns8 config.

(cherry picked from commit bf3fffff67e1de78e9387a93674d471bf4291604)