When the ARES_FLAG_DNSSEC is specified, use the nameservers that are tagged as trusted.

The trusted nameservers are read from PATH_RESOLV_SEC_CONF which
is /etc/resolv-sec.conf in Linux. That file is assumed to have the
same format as /etc/resolv.conf and contain all the trusted for
DNSSEC nameservers.