Describe the bug
When the client-subnet-always-forward option is enabled and the send-client-subnet field is left empty, it is expected that only downstream queries containing an ECS record would be sent upstream. However, the current behavior is that all queries are sent upstream with either the downstream ECS or the generated one, disregarding the "send-client-subnet" setting entirely.

To reproduce
Steps to reproduce the behavior:

1. Set client-subnet-always-forward to yes and do not specify a send-client-subnet
2. Perform a query with no ECS included
3. Check the produce upstream query

Expected behavior
The upstream query should not include an ECS option generated with the client source address.

System:

• Unbound version: 1.17.0
• OS: Linux
• unbound -V output:

Version 1.17.0
Configure line: --with-libevent --enable-subnet --enable-dnstap
Linked libs: libevent 2.1.8-stable (it uses epoll), OpenSSL 1.1.1k  FIPS 25 Mar 2021
Linked modules: dns64 subnetcache respip validator iterator
BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues