[9.18] [CVE-2026-3592] sec: usr: Limit resolver server list size

[9.18] [CVE-2026-3592] sec: usr: Limit resolver server list size

When resolving a domain with many nameservers that share overlapping IP addresses (e.g., 10 NS records all pointing at the same set of addresses), BIND could previously waste time querying duplicate addresses and build up excessively large server lists. Deduplicate addresses in the resolver's server list so that each unique IP is only queried once per resolution attempt, regardless of how many NS records point to it and cap the number of addresses stored per nameserver name to 6 (combined A and AAAA), preventing memory and CPU overhead from domains with unusually large NS/glue sets.

Closes isc-projects/bind9#5641

Backport of !909

Merge branch 'backport-5641-selfpointedglue-9.18' into 'security-bind-9.18'

See merge request isc-private/bind9!954