Verify DNS records on the queried child domain

Custom-domain CNAME and SAML TXT checks accepted answers without
confirming the record owner matched the hostname being verified, so
an apex record could satisfy verification for a subdomain. CAA checks
also looked only at the exact hostname and ignored parent policy.

Add dnsverify helpers to compare owner names and walk from the
requested hostname up to the registrable apex for CAA (RFC 6844).
Require matching record owners for CNAME and TXT answers.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/iam/saml_domain_verifier.go

@@ -32,6 +32,7 @@ import (
 	"go.gearno.de/kit/pg"
 	"go.opentelemetry.io/otel/trace"
 	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/dnsverify"
 	"go.probo.inc/probo/pkg/gid"
 )
 
@@ -227,7 +228,7 @@ func (v *SAMLDomainVerifier) checkDNSTXTRecord(ctx context.Context, emailDomain
 
 	for _, answer := range resp.Answer {
 		txt, ok := answer.(*dns.TXT)
-		if !ok {
+		if !ok || !dnsverify.EqualNames(txt.Hdr.Name, emailDomain) {
 			continue
 		}