resolved: when DNSSEC mode is disabled, don't go beyond EDNS0 feature level

There's no point in talking to a server in DNSSEC mode when we don't
actually want to verify anything.

See: #5352