deborphan: add workaround for transitional package dnsutils

dnsutils became a transitional package with version 1:9.16.2-3 (as
present in current testing (bullseye) and unstable):

| % rmadison dnsutils
| dnsutils   | 1:9.9.5.dfsg-9+deb8u15       | oldoldstable      | amd64, armel, armhf, i386
| dnsutils   | 1:9.10.3.dfsg.P4-12.3+deb9u5 | oldstable         | amd64, arm64, armel, armhf, i386, mips, mips64el, mipsel, ppc64el, s390x
| dnsutils   | 1:9.10.3.dfsg.P4-12.3+deb9u6 | oldstable-new     | amd64, arm64, armel, armhf, i386, mips, mips64el, mipsel, ppc64el, s390x
| dnsutils   | 1:9.11.5.P4+dfsg-5~bpo9+1    | stretch-backports | amd64, arm64, armel, armhf, i386, mips, mips64el, mipsel, ppc64el, s390x
| dnsutils   | 1:9.11.5.P4+dfsg-5.1         | stable            | amd64, arm64, armel, armhf, i386, mips, mips64el, mipsel, ppc64el, s390x
| dnsutils   | 1:9.11.5.P4+dfsg-5.1+deb10u1 | stable-new        | amd64, arm64, armel, armhf, i386, mips, mips64el, mipsel, ppc64el, s390x
| dnsutils   | 1:9.16.2-3                   | testing           | all
| dnsutils   | 1:9.16.2-3                   | unstable          | all

It depends on bind9-dnsutils, which is available only in current testing
(bullseye) and unstable:

| % rmadison bind9-dnsutils
| bind9-dnsutils | 1:9.16.2-3    | testing    | amd64, arm64, armel, armhf, i386, mips64el, mipsel, ppc64el, s390x
| bind9-dnsutils | 1:9.16.2-3    | unstable   | amd64, arm64, armel, armhf, i386, mips64el, mipsel, ppc64el, s390x

If we switch our GRML_FULL package list from dnsutils to
bind9-dnsutils, then we would only support testing (bullseye) and
unstable but not any older release. To avoid this, mark dnsutils
as "keep" in deborphan, so it does not end up in the not_installable
list (and mark failing tests in Jenkins/CI).