resolved: explain why .alt is not a negative trust anchor

RFC 9476 reserves the .alt pseudo-TLD for names that are resolved by
protocols other than DNS. #32284 proposes adding .alt to the built-in
negative trust anchors. We don't need that entry. dns_name_dont_resolve()
returns true for .alt names. We never send a lookup of a .alt name to a DNS
server, and we synthesize an NXDOMAIN reply instead. Lookups of .alt names
never go through DNSSEC validation.

Let's explain why the list has no .alt entry in a comment next to the list,
so that the same question doesn't come up again.

(cherry picked from commit 993c81a797)
(cherry picked from commit ca62633f08)

src/resolve/resolved-dns-trust-anchor.c

@@ -192,6 +192,11 @@ static int dns_trust_anchor_add_builtin_negative(DnsTrustAnchor *d) {
                 "170.0.0.192.in-addr.arpa\0"
                 "171.0.0.192.in-addr.arpa\0";
 
+        /* RFC 9476 reserves the .alt pseudo-TLD for names that are resolved by protocols other than DNS.
+         * dns_name_dont_resolve() returns true for .alt names. We hence never send a lookup of a .alt name
+         * to a DNS server, and synthesize an NXDOMAIN reply instead. Lookups of .alt names never go through
+         * DNSSEC validation. The list above doesn't need an entry for .alt for that reason. */
+
         int r;
 
         assert(d);