Empty DNS= and FallbackDNS= in resolved.conf were blocking VPN DNS
servers when VPN clients replaced /etc/resolv.conf.
Removing these empty values allows systemd-resolved to:
- Use DHCP DNS from network interfaces (existing behavior)
- Fall back to system defaults when needed
- Switch to 'foreign' mode for VPN DNS override
Fixes#1509