CLSA-2026-1792590954 bind: Fix of 3 CVEs

CVE-2026-19941: require an NSEC wildcard proof to be signed by the same zone as the validated NOQNAME proof - CVE-2026-75029: skip duplicate records of singleton types when parsing a message - CVE-2026-77119: ignore NSEC3 records from zones that do not enclose the DS name when proving an insecure...