modules/dns64: implement more properties from RFC

- don't synthesize if +CD
- bound synthesized TTL by SOA's TTL
- set AD flag if synthesizing from secure NODATA and A.
- review the RFC for properties that the module is missing
19 jobs for dns64
in 11 minutes and 2 seconds and was queued for 7 seconds