modules/policy: DENY home.arpa. special-use domain

Well, it's just an approximation... if the user specifies a forwarding
policy, any special names will also get forwarded, even though the RFC
says not to.  And this code will also reply NXDOMAIN to home.arpa. DS.

For local. we kept the default behavior, after some research,
as there seems almost no benefit and there's risk of having
a validating resolver downstream that doesn't treat local.  Refs.:
- home.arpa.: 4. from https://tools.ietf.org/html/rfc8375#section-4
- local.: 4. from https://tools.ietf.org/html/rfc6762#section-22.1