lib/rules: fix RPZ if it contains apex NS record
The spec even requires (at least one) NS record in apex https://datatracker.ietf.org/doc/html/draft-vixie-dns-rpz-00#section-2 but until now the implementation took it as override for the root NS, which obviously broke resolution (depending on the supplied name/s).