bind: Fix of 2 CVEs

CVE-2026-13321: Reject NSEC records whose next owner name points outside the signer's zone, which let a signed zone forge proofs of non-existence for other zones - CVE-2026-11622: Reference count the cache rdataset headers so a superseded generation is freed as soon as nothing holds it, instead...