resolver: a root server's reply marked recursion available means interception (closes #300)

dnswatcher never asks for recursion and a root server never offers it,
so a reply marked recursion available from a root server's address
came from a resolver on the network answering in its place. Such a
reply is now passed over, and when every root server refused or gave
one, the lookup fails with the existing "this network intercepts DNS
queries", whether or not that resolver had the name cached. Before, a
cached name was checked against the resolver's second-hand answer.

On such a network dnswatcher and its tests fail with that error, by
design; nothing asks again another way or works around it. A live test
passes public resolvers as the root servers and expects the error.

Model: opus-5-5

internal/resolver/errors.go

@@ -53,9 +53,19 @@ var (
 		"reply truncated and its retry over TCP failed",
 	)
 
+	// ErrRecursionAvailable is the reason a reply from a root server's
+	// address marked recursion available is not used. Root servers offer
+	// no recursion, so the reply came from something on the network
+	// answering in their place.
+	ErrRecursionAvailable = errors.New(
+		"reply marked recursion available, so not from a root server",
+	)
+
 	// ErrIntercepted is returned when every root server refused a
-	// query. Root servers refuse no query, so the refusals came from
-	// something on the network answering in their place.
+	// query or gave a reply marked recursion available. Root servers do
+	// neither, so those replies came from something on the network
+	// answering in their place. On such a network dnswatcher fails with
+	// it, by design: nothing works around the interception.
 	ErrIntercepted = errors.New("this network intercepts DNS queries")
 
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain