validator: fix CNAME to NXDOMAIN in a single answer
Real example: cname.nohats.ca
This case was handled for forwarding only, presumably because it happened more often (no need to be withing single zone to be within single answer); now the approach is the same.