dns/bind: add HTTPS record type support

[mbedworth]

Important notices

Before you submit a pull request, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I opened an issue first for non-trivial changes and linked it below.
• AI tools were used to create at least part of the code submitted herewith.

If AI was used, please disclose:

• Model used: n/a
• Extent of AI involvement: AI assistance was used for code review and testing.

---

Describe the problem

The BIND record model (Record.xml) does not include HTTPS as a valid record type, making it impossible to add HTTPS/SVCB resource records (RFC 9460) through the plugin GUI or API. BIND 9.18+ supports HTTPS records natively in zone files, but the OPNsense validation layer rejects the type before it reaches named.

---

Describe the proposed solution

Add HTTPS to the OptionValues list in models/OPNsense/Bind/Record.xml. This is a one-line change that follows the same pattern as the existing record types (SRV, TLSA, etc.).

HTTPS records (RFC 9460) are used for service binding and parameter discovery. A common use case is advertising DoH endpoints with their path and ALPN parameters so RFC 9460-aware clients can discover them automatically, for example:

doh.example.com.  IN HTTPS  1 .  alpn="h2"  dohpath="/dns-query{?dns}"

The zone file template already emits records generically as name type value, so no template changes are required — only the model validation needs updating.

Testing

Tested on OPNsense 26.1 with BIND 9.20:

• GUI: HTTPS type appears in the record type dropdown after the model is deployed
• API: addRecord with "type": "HTTPS" returns {"result":"saved"} and the record is written to config.xml
• Zone file: template correctly renders name HTTPS value in the zone file
• Resolution: dig TYPE65 returns NOERROR with the correct SvcParams after a zone reload

[mimugmail]

Can you please adjust your PR to only include HTTPS support? There's some mixed stuff in there (also in your other PR's).

[mbedworth]

Thanks @mimugmail — good catch. I've rebased onto current master and dropped the unrelated security/wazuh-agent/opnsense-fw change (that fix already landed via #5104/#5116, so it was a stale duplicate commit). #5425 now contains only the single-line HTTPS record-type addition to Record.xml. I'll scope the DoT (#5424) and RPZ (#5399) PRs the same way.

[mimugmail]

Thx!