resolvectl: reject --raw for regular lookups

--raw only affects ResolveRecord output. Without --type= or an
RFC4501 dns: URI, query takes the ResolveHostname/ResolveAddress
paths, where --raw was silently ignored.

Reproducer:

  build/resolvectl --raw query localhost

Before:

  The command exited successfully and printed regular text output,
  such as:

    localhost: 127.0.0.1

After:

  The command fails before issuing a lookup:

    --raw may only be combined with --type= or dns: URIs.

Follow-up for: 05ea7e87b6

man/resolvectl.xml

@@ -482,6 +482,10 @@
         types: SSHFP, TLSA, OPENPGPKEY where this dumps the key material only; and A, AAAA where
         this dumps the address data.</para>
 
+        <para>This option may only be used with <option>--type=</option> or an RFC 4501
+        <literal>dns:</literal> URI, which both perform DNS resource record lookups. It may not be combined
+        with regular hostname or address lookups.</para>
+
         <xi:include href="version-info.xml" xpointer="v239"/></listitem>
       </varlistentry>
 

src/resolve/resolvectl.c

@@ -894,6 +894,10 @@ static int verb_query(int argc, char *argv[], uintptr_t _data, void *userdata) {
                                 int family, ifindex;
                                 union in_addr_union a;
 
+                                if (arg_raw != RAW_NONE)
+                                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                                               "--raw may only be combined with --type= or dns: URIs.");
+
                                 r = in_addr_ifindex_from_string_auto(*p, &family, &a, &ifindex);
                                 if (r >= 0)
                                         RET_GATHER(ret, resolve_address(family, &a, ifindex));

test/units/TEST-75-RESOLVED.sh

@@ -565,6 +565,10 @@ testcase_08_resolved() {
     run resolvectl query signed.test
     grep -qF "signed.test: 10.0.0.10" "$RUN_OUT"
     grep -qF "authenticated: yes" "$RUN_OUT"
+    (! run resolvectl --raw query localhost)
+    grep -qF -- "--raw may only be combined with --type= or dns: URIs." "$RUN_OUT"
+    resolvectl --raw=packet query --type=A signed.test >"$RUN_OUT"
+    test -s "$RUN_OUT"
     run dig @ns1.unsigned.test +short MX signed.test
     grep -qF "10 mail.signed.test." "$RUN_OUT"
     run resolvectl query --legend=no -t MX signed.test