CVE-2026-13321: Reject NSEC records whose next owner name points outside
the signer's zone, which let a signed zone forge proofs of non-existence
for other zones
CVE-2026-11622: Reference count the cache rdataset headers so a superseded
generation is freed as soon as nothing holds it, instead of growing the
node's down chain until the node itself becomes unreferenced