an ANY query at a zone cut point will return a delegation, except if DNS_DBFIND_GLUEOK is set, in which case DNS_R_ZONECUT will be returned as before. Someday it would probably be a good idea to get rid of DNS_R_ZONECUT entirely and just return DNS_R_GLUE in that case, but I was afraid to do that now since it might break things. These changes pass all system tests.