Supply a --dns-search to blank the inherited resolv.conf search

In the absence of *either* a `--dns` or `--dns-search` argument,
Docker will write a `/etc/resolv.conf` based on the host's. Since, in
general, we rely on the DNS search path being empty (so that the
resolver uses the local domain), we want to blank the
`/etc/resolv.conf` by providing `--dns-search=.` when running a
container.

However, if there's a `--dns-search=` in the remainder of the args,
Docker will append them to the dot, which breaks resolution. Not good.

So, we only "blank" the search path if there's no `--dns-search`
argument present already.