Changed default policy for DNSSEC to "validate".
Changed default policy for DNSSEC to "validate".

Default: validate; this allows users to specify either "validate" or "secure_only" in the local getdns.conf because otherwise the system default should not be downgradable.
If line #4 is uncommented, it wil overwrite line #2.
getdnsapi/libnss_getdns,getdnsapi/libnss_getdns,getdnsapi/libnss_getdns