improve safety and sanity of from_server_role resolver

Two main changes:

* don't create a resolv.conf with no nameservers
* sort the nameservers found by search