core/dnsserver: add opt-in opcode admission (#8469)

Keep miekg/dns's default request policy unless a plugin explicitly registers an additional opcode. Aggregate the policy at the listener, then enforce it again after zone routing so mixed server blocks on one socket remain isolated.

Apply the same policy to UDP, TCP, and DNS-over-TLS while preserving TSIG verification and the one-question requirement.

Signed-off-by: houyuwushang <liuluoqianqiu@outlook.com>

core/dnsserver/config_test.go

@@ -5,6 +5,8 @@ import (
 
 	"github.com/coredns/caddy"
 	"github.com/coredns/coredns/plugin"
+
+	"github.com/miekg/dns"
 )
 
 func TestKeyForConfig(t *testing.T) {
@@ -102,3 +104,16 @@ func TestPropagateConfigParamsMaxTCPQueries(t *testing.T) {
 		t.Fatalf("expected MaxTCPQueries to propagate to second config as %d, got %v", n, second.MaxTCPQueries)
 	}
 }
+
+func TestPropagateConfigParamsAllowedOpcodes(t *testing.T) {
+	first := &Config{}
+	first.firstConfigInBlock = first
+	first.AllowOpcode(dns.OpcodeUpdate)
+	second := &Config{firstConfigInBlock: first}
+
+	propagateConfigParams([]*Config{first, second})
+
+	if !second.acceptsOpcode(dns.OpcodeUpdate) {
+		t.Fatal("expected UPDATE admission to propagate to every zone in the server block")
+	}
+}