[9.16] [CVE-2026-5946] sec: usr: Disable recursion, UPDATE, and NOTIFY for non-IN...

[9.16] [CVE-2026-5946] sec: usr: Disable recursion, UPDATE, and NOTIFY for non-IN views

Recursion, dynamic updates (UPDATE), and zone change notifications
(NOTIFY) are now disabled for views with a class other than IN
(such as CHAOS or HESIOD); authoritative service for non-IN zones
(e.g. version.bind in class CHAOS) continues to work as before.
Servers configured with recursion yes in a non-IN view will log a
warning at startup, and named-checkconf flags the same condition.
UPDATE and NOTIFY messages that specify the meta-classes ANY or NONE
in the question section are now rejected with FORMERR.

This addresses a set of closely related security issues collectively
identified as CVE-2026-5946. ISC would like to thank Mcsky23 for
bringing these issues to our attention.

Backport of https://gitlab.isc.org/isc-private/bind9/-/merge_requests/936

Merge branch 'each-security-disable-chaos-recursion-security-bind-9.16' into 'security-bind-9.16'

See merge request isc-private/bind9!1020