fix: run dnssec options before domain options

[ekristen]

systemd-resolved has a bug with DNSSEC. If domains are added prior to setting or changing the DNSSEC setting, the domains use the previous setting, it also seems that it requires a restart of systemd to reset their DNSSEC settings to what they should be.

By moving the DNSSEC stanza this ensures that the DNSSEC setting is applied before any domains are added to resolved which ensures they have the appropriate DNSSEC setting.

To reproduce this you can use a DNS server that doesn't support DNSSEC and then set DOMAIN and DOMAN-ROUTE for a domain you want to resolve, without this change queries will fail, if you restart resolved they will start working.

To validate this works, restart your system, put this change in place and connect to the VPN, queries will work immediately.

[ekristen]

@jonathanio does the above description make sense? Do I need to provide any additional information? Thanks.

[jonathanio]

I've had a look at the code, and that's fine. I needed to re-remember if the options were processed in order of the configuration, not in an order defined in the script, and this will work. I thought there should be a test for this change, but none of the other tests explicitly depend on the order of the calls, so I'll just merge.