Butane unit dropins write to /etc/systemd/system/<unit>.d/, but
DNSStubListener is a systemd-resolved config option that belongs in
/etc/systemd/resolved.conf.d/. Use storage.files instead so Ignition
places it in the correct location.
systemd-resolved must run for host DNS (nss/resolv.conf), but its stub
listener on 127.0.0.53:53 conflicts with Unbound's bind to 0.0.0.0:53.
Replace masking with DNSStubListener=no dropin + static resolv.conf
pointing to 1.1.1.1 and 9.9.9.9, so the host can resolve without
occupying port 53.
