Properly handle zonecuts

[coreyhaines]

When responding to a question for a record under a zonecut, we should only return an authority section that points to the authoritative servers.

There are two primary behaviors implemented:

• If a record is queried that is under a zonecut, do not send back answer, only authority
• If a CNAME record is queried, DO send back answer if pointing to a name in the zone (we are authority).

This behavior is tested in dnstest.

This PR implements a solution that is not optimized, but does implement the desired behaviour. Expectation is that a new PR will be created to handle optimization.