Bugfix: use correct TTL values in negative responses

I apparently misread RFC 2308 back when I first implemented
this, and nobody has noticed the bug until now.

For some reason I got it in my head that the resolvers
were supposed to look at the ncache/minimum field of the SOA
record directly for themselves to identify the negative
cache lifetime.  However, the RFC-correct behavior is that
the auth server is responsible for setting the primary TTL
of the SOA record in negative responses to the minimum of
the ncache/minimum field and the actual SOA TTL.

Conflicts:
	t/007plugins/003dync.t