policy: actions don't populate OPT when they should
If an OPT record is present in a received request, compliant responders MUST include an OPT record in their respective responses.
Original report: https://forum.turris.cz/t/kresd-response-missing-opt-pseudo-rr/14437 It causes practical issues with systemd-resolved (see the report).