resolver: ask again over TCP when a reply offers recursion (closes #300)

dnswatcher never asks for recursion, so a reply marked recursion
available comes from a resolver on the network answering in the
server's place, as on a network that sends all DNS to one resolver.
Such a resolver answers only from its cache, or with SERVFAIL or
REFUSED, which made make check fail there.

A reply over UDP marked so is now asked again over TCP, which many such
networks leave alone, and the TCP reply is used. A reply from a root
server's address still marked so is not used, and when every root
server refuses or gives one, the error is the existing "this network
intercepts DNS queries".

Model: opus-5-5

internal/resolver/errors.go

@@ -53,9 +53,18 @@ var (
 		"reply truncated and its retry over TCP failed",
 	)
 
+	// ErrRecursionAvailable is the reason a reply from a root server
+	// marked recursion available is not used. Root servers offer no
+	// recursion, so the reply came from something on the network
+	// answering in their place.
+	ErrRecursionAvailable = errors.New(
+		"reply marked recursion available, so not from a root server",
+	)
+
 	// ErrIntercepted is returned when every root server refused a
-	// query. Root servers refuse no query, so the refusals came from
-	// something on the network answering in their place.
+	// query or gave a reply marked recursion available. Root servers do
+	// neither, so those replies came from something on the network
+	// answering in their place.
 	ErrIntercepted = errors.New("this network intercepts DNS queries")
 
 	// ErrCNAMEDepthExceeded is returned when a CNAME chain