Shared Address Space (RFC 6598) reverse queries are forwarded upstream, and SERVFAIL with DNSSEC validation

sudnHandlers covers the RFC 6761 private reverse zones (10.in-addr.arpa, 16-31.172.in-addr.arpa, 168.192.in-addr.arpa) but not the RFC 6598 Shared Address Space reverse zones 64.100.in-addr.arpa through 127.100.in-addr.arpa, so those queries are forwarded to the upstream.

RFC 6598 §4:

Reverse DNS queries for Shared Address Space addresses MUST NOT be forwarded to the global DNS infrastructure. DNS Providers SHOULD filter requests for Shared Address Space reverse DNS queries on recursive nameservers.

With dnssec.validate: true it is also user-visible. The upstream filters the query per that same section, so the NXDOMAIN it returns is unsigned; 100.in-addr.arpa is signed; validation therefore fails closed and the client gets SERVFAIL instead of NXDOMAIN.

Reproduce

ports:
  dns: 127.0.0.1:15653
upstreams:
  groups:
    default:
      - 1.1.1.1
dnssec:
  validate: true

dig @127.0.0.1 -p 15653 -x 100.64.0.1        -> SERVFAIL
dig @127.0.0.1 -p 15653 -x 100.127.255.254   -> SERVFAIL
dig @127.0.0.1 -p 15653 -x 10.0.0.1          -> NXDOMAIN   (handled by SUDN)
dig @127.0.0.1 -p 15653 -x 192.168.1.1       -> NXDOMAIN   (handled by SUDN)
dig @1.1.1.1 -x 100.64.0.1                   -> NXDOMAIN

WARN dnssec: No RRSIG for 1.0.64.100.in-addr.arpa. but zone is secure - treating unsigned answer as bogus
WARN dnssec: DNSSEC validation failed for 1.0.64.100.in-addr.arpa. - returning SERVFAIL

With dnssec.validate: false the same queries return NXDOMAIN — the forwarding happens either way, validation only surfaces it.

Reproduced on v0.34.0 and v0.35.0.

Expected

NXDOMAIN answered locally, as for the RFC 6761 private reverse zones.

Suggested fix

Map 64.100.in-addr.arpa. … 127.100.in-addr.arpa. to sudnNXDomain in resolver/sudn_resolver.go, alongside the existing RFC 6761 entries.