Reference count rules returned by dns_ssutable_checkrules

The rules returned by dns_ssutable_checkrules can be used after an intervening reload/reconfig when processing an update request causing the old instance of the rule to be freed while an external pointer to them exists. This resulted in an assertion failure in dns_ssurule_max when it was called with an out of date pointer. Reference count the rules to prevent them being freed too early.