chg: usr: Fix a resolver stall on a CNAME response to a DS query

A validating resolver could stall for about twelve seconds and then return
SERVFAIL when an authoritative server answered a DS query with a CNAME. Such
responses are now rejected promptly, so the query fails fast instead of
hanging.

Closes #5878

Merge branch '5878-reject-cname-at-dnssec-types' into 'main'

See merge request isc-projects/bind9!11867