Return FORMERR if no query and known OPCODE, but NOTIMPL if unknown OPCODE
This change fixes: https://chat.dns-oarc.net/community/channels/town-square/xkom8diuqindmbh748r3ap7s1c
Anand: So when I run dig @BIND +norec +nsid +nocookie +header I get FORMERR, but I get the OPT record with NSID. The same against Knot DNS gives me NOTIMP, but it does return the OPT record with NSID. Finally, NSD gives me FORMERR, and no OPT record.
And still respects: https://mailarchive.ietf.org/arch/msg/dnsop/LlHh7_RjyYby1j4_rnvrfkAH6dM/