Fix NOTIFY missing SOA serial by placing SOA in answer section

RFC 1996 section 3.10 requires the SOA RR carrying the new zone serial
to be placed in the answer section of a NOTIFY message. BIND9's notify
processing looks for the SOA there and, when it is absent, logs that the
NOTIFY does not contain a SOA serial.

Both SendClientDNSNotify and SendNSNotify were appending the SOA RRset
to the authority section instead of the answer section, which is why
BIND9 reported the missing serial. Move the append to msg.answer in both
handlers so receivers can correctly extract the new serial.

netbox_dns_bridge/notify_handler.py

@@ -83,7 +83,7 @@ class SendClientDNSNotify(JobRunner):
                     f"invalid. invalid. {soa_serial} 60 10 1209600 0",
                 )
                 soa_rrset = dns.rrset.from_rdata(zone_name, 0, soa_rdata)
-                msg.authority.append(soa_rrset)
+                msg.answer.append(soa_rrset)
                 msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name)
 
                 for client in clients:
@@ -165,7 +165,7 @@ class SendNSNotify(JobRunner):
             dns.rdatatype.SOA,
             f"invalid. invalid. {soa_serial} 60 10 1209600 0",
         )
-        msg.authority.append(dns.rrset.from_rdata(fqdn, 0, soa_rdata))
+        msg.answer.append(dns.rrset.from_rdata(fqdn, 0, soa_rdata))
         msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name)
 
         for ip in ns_targets: