Update sed-foo to enable nss-systemd and add UNAVAIL fallback for resolve
Only fall back to "dns" if nss-resolve is not installed (for the
architecture of the calling program). Once it is, we never want to
fall back to "dns" as that breaks enforcing DNSSEC verification and
also pointlessly retries NXDOMAIN failures.