Parse DNSSEC AD and CD bits

Parse authentic data (AD) and checking disabled (CD) bits according to
RFC 2535. Leaves the Z field as-is, in case users are already handling
this elsewhere and depend on the value being the integer for all 3 bits.

https://www.rfc-editor.org/rfc/rfc2535#section-6.1

Fixes #2672

scripts/base/init-bare.zeek

@@ -3837,7 +3837,9 @@ type dns_msg: record {
 	TC: bool;	##< Truncated packet flag.
 	RD: bool;	##< Recursion desired flag.
 	RA: bool;	##< Recursion available flag.
-	Z: count;	##< TODO.
+	Z: count;	##< 3 bit field (includes AD and CD)
+	AD: bool;	##< authentic data
+	CD: bool;	##< checking disabled
 
 	num_queries: count;	##< Number of query records.
 	num_answers: count;	##< Number of answer records.