[Watchdog] Validate Unbound over IPv4 and IPv6

[pi0n00r]

Contribution Guidelines

• I've read the contribution guidelines and wholeheartedly agree to them

What does this PR include?

Short Description

This PR keeps the existing Unbound resolution and DNSSEC coverage, binds those
checks to the actual Unbound container addresses, and adds equivalent IPv6
coverage when Mailcow IPv6 is enabled.

It is a clean follow-up to #6626. In particular, it preserves the established
check_dns.sh check and strengthens rather than removes the DNSSEC check.

The watchdog now:

• discovers the matching Unbound container IPv6 address through the existing
  Docker API service and Compose labels, with bounded retries;
• runs the established ordinary DNS check against Unbound over each enabled
  transport;
• requires an authenticated answer for valid signed data;
• in the default strict mode, requires a deliberately bogus DNSSEC chain to
  return SERVFAIL;
• derives strict versus permissive behavior from the same unbound.conf file
  mounted into the Unbound container;
• accepts Unbound's documented permissive behavior without ever accepting a
  bogus answer as authenticated;
• counts a failed polling round once even when several assertions fail; and
• reports IPv6 address-discovery trouble without restarting Unbound for a
  Docker API or network-configuration failure.

Strict validation remains the stock behavior. Permissive behavior follows
Unbound's documented behavior
only when the active configuration explicitly selects it.

The watchdog image tag is advanced from 2.11 to 2.11a because the image
source changes.

Affected Containers

• watchdog-mailcow

Did you run tests?

Yes.

What did you test?

• helper-scripts/tests/test_watchdog_dnssec.sh
• Bash syntax for the watchdog and fixture test
• ShellCheck at error severity for the upstream watchdog
• Full ShellCheck for the new fixture test
• Docker API IPv6 selection from mocked container metadata
• strict DNSSEC success and bogus-chain rejection
• permissive DNSSEC success without treating bogus data as authenticated
• strict/permissive mode detection from Unbound configuration fixtures
• one-health-point aggregation for a failed polling round
• bounded IPv6 discovery and non-restart classification
• explicit IPv4/IPv6 family and destination arguments
• Compose configuration mounting the active Unbound configuration read-only
• Compose YAML structure
• a clean OCI image build from data/Dockerfiles/watchdog
• syntax and marker verification inside the built image
• contained rootless Podman tests against Unbound on a dual-stack network:
  • strict mode over IPv4 and IPv6;
  • permissive mode over IPv4 and IPv6;
  • authenticated com. SOA answers; and
  • rejection of authenticated data from dnssec-failed.org

The candidate has not yet been exercised in a live Mailcow stack, so the
contained network tests do not claim a production restart-cycle validation.

What were the final results? (Awaited, got)

Expected:

• the existing ordinary DNS check remains active;
• strict mode fails unless valid data authenticates and bogus data is rejected;
• permissive mode still authenticates valid data and never marks bogus data
  authenticated;
• a polling round cannot consume more than one health point;
• IPv6 checks target the Unbound container only when IPv6 is enabled; and
• address-discovery failures are reported as configuration trouble rather than
  resolver-process failures.

Got:

• all deterministic watchdog tests passed;
• ShellCheck and Bash syntax checks passed;
• Compose structure validation passed;
• the watchdog image built successfully and contained the patched script; and
• strict and permissive dual-stack Podman validation passed.

The 2.11a tag follows the image-rebuild contribution rule. It is expected to
remain unavailable until the upstream image pipeline publishes it after merge;
its pre-merge absence is not a validation failure.