lib/resolve answer_finalize: don't SERVFAIL bogus +cd

As kresd works now, typically we do not know whether these records are bogus, as with +cd we do not attempt validation. Still, it's possible that we have those records in cache from an occasion without +cd, in which case we know they're bogus and this regression happened.

The potential impact of this issue seems minimal.