Update sed-foo to enable nss-systemd and add UNAVAIL fallback for resolve
    
    Only fall back to "dns" if nss-resolve is not installed (for the
    architecture of the calling program). Once it is, we never want to
    fall back to "dns" as that breaks enforcing DNSSEC verification and
    also pointlessly retries NXDOMAIN failures.
    
    C.f. https://anonscm.debian.org/cgit/pkg-systemd/systemd.git/commit/?id=5e00954