resolved: tweak how we signal authoritative answers
    
    let's make sure we set the "aa" bit in the stub only if we answer with
    fully authoritative data. For this ensure:
    
    1. Either all data is synthetic, including all CNAME/DNAME redirects
    
    2. Or all data comes from the local trust anchor or the local zones
       (i.e. not the network or the cache)
    
    Follow-up for 4ad017cda57b04b9d65e7da962806cfcc50b5f0c