[9.20] chg: usr: Fix a resolver stall on a CNAME response to a DS query

A validating resolver could stall for about twelve seconds and then return
SERVFAIL when an authoritative server answered a DS query with a CNAME. Such
responses are now rejected promptly, so the query fails fast instead of
hanging.

Closes #5878

Backport of MR !11867

Merge branch 'backport-5878-reject-cname-at-dnssec-types-9.20' into 'bind-9.20'

See merge request isc-projects/bind9!12147