dnsmasq: add optional DNSSEC support.

Closes #31204