[Unbound:Blocklists]: Add advanced policy option to ignore domain blocks from other matched policies

[dstapa]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

This is regarding the use case in the OP of this thread: https://forum.opnsense.org/index.php?topic=51137.0

The behavior of the code currently is to block the query when the domain exists in any policy for which the client IP is in the list of source networks. This includes the empty set (source_nets=[]) which is the default match for any source IP (including localhost).

Sometimes we might want to override this behavior on a per-policy basis so that the domain is resolved even if a broader matching policy would block it. The proposal is to add an advanced mode option to the policy settings to enable this.

Environment

OPNsense 26.1.2_5 (amd64).