CoreDNS enforces rejection of RFC 2136 UPDATE on DoH/DoQ/gRPC

CoreDNS has addressed a security vulnerability, as detailed in the GitHub Security Advisory database, affecting its handling of RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC. Previously, these transports allowed UPDATE messages to bypass rejection policies applied to UDP, TCP, and DoT. The issue arose because affected listeners did not enforce the `dns.DefaultMsgAcceptFunc` policy, which rejects all opcodes except QUERY and NOTIFY. This allowed unauthenticated clients to manipulate DNS records if the upstream DNS server trusted CoreDNS's source address or authenticated connection without requiring end-to-end TSIG.

The fix ensures that the rejection policy is applied uniformly across all transport protocols by using `dnsutil.UnpackRequest` before dispatching requests. Operators should verify whether their upstream DNS servers rely solely on CoreDNS's source address or connection authentication for trust. If so, they should confirm that their upstream servers enforce TSIG or other end-to-end authentication mechanisms to mitigate risks. Additionally, operators should test all plugins that interact with upstream DNS servers to ensure compatibility with the updated rejection enforcement logic.