Update to 9.21.17 (#2415843)

Security Fixes:

• Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

New Features:

• Add support for Extended DNS Error 9 (Missing DNSKEY).
• Add support for Extended DNS Error 13 (Cached Error).
• Add support for Generalized DNS Notifications.

Features Changes:

• Add more information to the rndc recursing output about fetches.
• Enforce bounds of multiple configuration options.

Bug Fixes:

• Fix inbound IXFR performance regression.
• Make DNSSEC key rollovers more robust.
• Fix a catalog zone issue, where member zones could fail to load.
• Fix slow speed when signing a large delegation zone with NSEC3 opt-out.
• Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.
• Fix a possible catalog zone issue during reconfiguration.
• Fix the charts in the statistics channel.

https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17