unbound: run in chroot

This also fixes a problem where extraConfig gets put after the **forward-zone** section, which is not legal.