dns/bind: add validate-except config option for split dns on forward zones

[cm-rudolph]

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.
When running a split-horizon DNS setup where the public domain is DNSSEC-signed, internal clients experience SERVFAIL errors when querying internal, unsigned forward zones. While BIND implicitly trusts local primary zones and bypasses validation for them, forwarded zones trigger strict recursive checks. BIND attempts to validate the forwarded zone against the public chain of trust and naturally fails.

Currently, the BIND plugin UI does not expose the validate-except directive, making it impossible to exclude these internal zones/subdomains from DNSSEC validation without manual backend workarounds that get overwritten by the template engine.

Describe the solution you'd like
Add a config option to the plugins general configuration page. I'll file a PR on the change.

Describe alternatives you've considered
None.

Additional context
None.

[cm-rudolph]

To be honest, I initially thought this change were necessary for primary zones hosted locally by bind, too. But I got the SERVFAIL due to different reasons. After implementing the change and trying to negative test it (by removing the validate-except with the local primary zone from the config), I realized that this change is necessary for forward zones only when bind is checking unsigned split dns zones of another internal DNS.

I am not sure of how much value it is to other users of OPNsense. Probably the option should be hidden as "advanced" feature or the PR / issue can be closed at all.

[cm-rudolph]

This also gets fixed by #5588, which is a more generic solution on that issue, that doesn't bloat the UI.