dns/powerdns-recursor: update to 4.9.0

ChangeLog: https://blog.powerdns.com/2023/06/30/powerdns-recursor-4-9-0-released

• The performance impact of metrics collection has been reduced by using lock-free non-atomic thread-local counters.
• The packet cache is sharded and shared by all threads.
• The TTL of negative answers in the packet cache can now be controlled separately from positive and failure answers.
• The rec_control trace_regex command writes the generated trace information to a specified file instead of the general log. The trace information contains more precise timestamps and DNSSEC validation information.
• If extended-resolution-errors is enabled EDNS errors are now generated in more cases, specifically when authoritative servers for a zone are unreachable or when synthesising answers by e.g. using the aggressive NSEC cache.
• The aggressive NSEC cache has been changed not to store NSEC3 entries which cover only a small fraction of possible names. This also allows switching off the aggressive cache for NSEC3 only.
• It is now possible to switch off root-refreshing completely.
• Proper handling of security policies that restrict the use of specific DNSSEC algorithms on RHEL9 derived systems.

PR: 272343
Reported by: tremere@cainites.net (maintainer)