resolved: demote the global unicast scope

This will greatly reduce the number of cases where the global unicast
scope overlaps with link scopes configured as default-route, making it
feasible to use the global DNS setting in conjunction with per-link dns
servers configured by the network.

This change is preferred over demoting links to default-route=no where
the user prefers to use the network provided DNS servers, and I expect
it is non-disruptive in that it should not degrade the efficacy of any
existing configuration.

man/systemd-resolved.service.xml

@@ -217,7 +217,10 @@
 
       <listitem><para>If a query does not match any configured routing domain (either per-link or global), it
       is sent to all DNS servers that are configured on links with the <varname>DefaultRoute=</varname>
-      option set, as well as the globally configured DNS server.</para></listitem>
+      option set.</para></listitem>
+
+      <listitem><para>If no links are configured with <varname>DefaultRoute=</varname>, it is sent to the
+      globally configured DNS server.</para></listitem>
 
       <listitem><para>If there is no link configured as <varname>DefaultRoute=</varname> and no global DNS
       server configured, one of the compiled-in fallback DNS servers is used.</para></listitem>

src/resolve/resolved-dns-scope.c

@@ -778,7 +778,8 @@ DnsScopeMatch dns_scope_good_domain(
                 if (!dns_scope_is_default_route(s))
                         return DNS_SCOPE_NO;
 
-                return DNS_SCOPE_MAYBE;
+                /* Prefer suitable per-link scopes where possible */
+                return s->link ? DNS_SCOPE_MAYBE : DNS_SCOPE_LAST_RESORT;
         }
 
         case DNS_PROTOCOL_MDNS: {