[9.18] Refactor dns_rpz unit to use single reference counting

Backport of !6864 (merged).

The backport was adapted for v9_18, which required some significant changes, and so needs a new review.

The backport doesn't include the 118ae669 commit, because it is already backported by !7251 (merged).