trust-dns testing

[daxpedda]

We are currently testing against https://one.one.one.one, because it's DNSSEC is invalid, but we do want to have something more reliable.
We are currently testing against https://google.com because it doesn't use DNSSEC.

The goal is to have an endpoint to test against that reliably does not support DNSSEC but works without DNSSEC.
Current testing endpoints like https://dnssec.fail have broken DNSSEC records but also don't support a connection without DNSSEC.