Fix enum inversion.

A change in Python 3.11's enum module caused IntEnum inversion to only
invert the bits associated with the (inferred) range of the flag,
meaning that ~dns.flags.DO only inverted 16 bits.  This meant that
calling want_dnssec(False) on a message would unconditionally set the
EDNS version field to 0.

dns/message.py

@@ -826,7 +826,7 @@ def want_dnssec(self, wanted: bool = True) -> None:
         if wanted:
             self.ednsflags |= dns.flags.DO
         elif self.opt:
-            self.ednsflags &= ~dns.flags.DO
+            self.ednsflags &= ~int(dns.flags.DO)
 
     def rcode(self) -> dns.rcode.Rcode:
         """Return the rcode.

tests/test_message.py

@@ -233,6 +233,18 @@ def test_EDNSVersionCoherence(self):
         m.use_edns(1)
         self.assertEqual((m.ednsflags >> 16) & 0xFF, 1)
 
+    def test_EDNSVersionCoherenceWithDNSSEC(self):
+        m = dns.message.make_query("foo", "A")
+        m.use_edns(1)
+        m.want_dnssec(True)
+        self.assertEqual((m.ednsflags >> 16) & 0xFF, 1)
+
+    def test_EDNSVersionCoherenceWithoutDNSSEC(self):
+        m = dns.message.make_query("foo", "A")
+        m.use_edns(1)
+        m.want_dnssec(False)
+        self.assertEqual((m.ednsflags >> 16) & 0xFF, 1)
+
     def test_SettingNoEDNSOptionsImpliesNoEDNS(self):
         m = dns.message.make_query("foo", "A")
         self.assertEqual(m.edns, -1)