resolve: enable RES_TRUSTAD towards the 127.0.0.53 stub resolver

[YmrDtnJu]

glibc 2.31 strips the AD flag, unless either the application specifies RES_TRUSTAD or the options in resolv.conf contain trust-ad.

See https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD

The DNS stub resolver will optionally send the AD (authenticated data) bit
in queries if the trust-ad option is set via the options directive in
/etc/resolv.conf (or if RES_TRUSTAD is set in _res.options). In this
mode, the AD bit, as provided by the name server, is available to
applications which call res_search and related functions. In the default
mode, the AD bit is not set in queries, and it is automatically cleared in
responses, indicating a lack of DNSSEC validation. (Therefore, the name
servers and the network path to them are treated as untrusted.)

As far as I can read the code in glibc that parses the options option in resolv.conf, older versions of glibc will simply ignore trust-ad as an unknown option.
See https://github.com/bminor/glibc/blob/7455b700279ec8baccf8dd7b119648f8b3e34eec/resolv/res_init.c#L645

[keszybz]

Looks reasonable, but the same change should be done to /run/systemd/resolve/stub-resolv.conf which is generated dynamically in src/resolve/resolved-resolv-conf.c.

[YmrDtnJu]

Done.

I don't think that we need to make the option conditional on anything. If resolved does not do DNSSEC validation, the AD bit will not be set anyway.

[DaanDeMeyer]

CI failure seems unrelated.