dns/bind: add validate-except config option (#5549)

[cm-rudolph]

Important notices

Before you submit a pull request, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I opened an issue first for non-trivial changes and linked it below.
• AI tools were used to create at least part of the code submitted herewith.

If AI was used, please disclose:

• Model used:
• Extent of AI involvement:

---

Describe the problem

When running a split-horizon DNS setup where the public domain is DNSSEC-signed, internal clients experience SERVFAIL errors when querying internal, unsigned forward zones. While BIND implicitly trusts local primary zones and bypasses validation for them, forwarded zones trigger strict recursive checks. BIND attempts to validate the forwarded zone against the public chain of trust and naturally fails.

Currently, the BIND plugin UI does not expose the validate-except directive, making it impossible to exclude these internal zones/subdomains from DNSSEC validation without manual backend workarounds that get overwritten by the template engine.

---

Describe the proposed solution

Expose the validate-except directive in the UI.

---

Related issue

#5549