resolver: never resend a refused query asking for recursion (closes #206)

queryDNS resent a query that a server refused, this time asking for
recursion, so on a network that intercepts DNS the answers could come
from a recursive resolver without anyone knowing. A refusal is now only
a refusal, and the server is passed over for the next.

When every server of a zone refuses, the error says so. When every root
server refuses, the error is ErrIntercepted: root servers refuse no
query, so something on the network is answering in their place.
FindAuthoritativeNameservers stops at that error instead of trying each
parent name, so the watcher's log line says it.

A live test asks Quad9, which refuses a query not asking for recursion,
so that the resend cannot come back unnoticed.

Model: opus-5-5

internal/resolver/resolver_test.go

@@ -341,13 +341,21 @@ func TestQueryNameserverIP_RecursiveResolverRefused(t *testing.T) {
 }
 
 // googleNameserverIPv4s returns the IPv4 addresses of google.com's
-// nameservers, the only addresses the resolver asks servers at.
+// nameservers. The resolver asks servers only at their IPv4 addresses.
 func googleNameserverIPv4s(t *testing.T, r *resolver.Resolver) []string {
 	t.Helper()
 
-	names := liveFindAuthoritative(t, r, "google.com")
+	var servers []string
 
-	return liveResolveNSIPs(t, r, names, len(names))
+	for _, ns := range liveFindAuthoritative(t, r, "google.com") {
+		for _, ip := range liveResolveIPs(t, r, ns) {
+			if net.ParseIP(ip).To4() != nil {
+				servers = append(servers, ip)
+			}
+		}
+	}
+
+	return servers
 }
 
 // TestQueryServers_EveryServerRefused asks all of google.com's