Fix DNS CAA check for IP scans and subdomains

- Skip CAA lookup entirely when NODE is an IP address; show
  "not checked (IP address scan)" instead of spuriously querying
  IP octets as domain labels and reporting "not offered"
- Force FQDN (trailing dot) on the initial caa_node before the
  walk loop so dig does not apply the resolv.conf search domain
  to the first query, which could return a false result
- Add a visible warning in the scan header when scanning by IP
  address, noting that trust/CAA and other domain-specific checks
  may be unreliable and the user should rescan with the hostname

testssl.sh

@@ -10268,13 +10268,17 @@ certificate_info() {
 
      out "$indent"; pr_bold " DNS CAA RR"; out " (experimental)    "
      jsonID="DNS_CAArecord"
+     if is_ipv4addr "$NODE" || is_ipv6addr "$NODE"; then
+          out "not checked (IP address scan -- no domain to query)"
+          fileout "${jsonID}${json_postfix}" "INFO" "not checked (IP address scan)"
+     else
           caa_node="$NODE"
+          [[ $caa_node =~ '.'$ ]] || caa_node+="."     # force FQDN to prevent dig search-domain expansion
           caa=""
           while [[ -z "$caa" ]] &&  [[ -n "$caa_node" ]]; do
                caa="$(get_caa_rr_record $caa_node)"
                tmp=${PIPESTATUS[@]}
                [[ $DEBUG -ge 4 ]] && echo "get_caa_rr_record: $tmp"
-          [[ $caa_node =~ '.'$ ]] || caa_node+="."
                caa_node=${caa_node#*.}
           done
           if [[ -n "$caa" ]]; then
@@ -10302,6 +10306,7 @@ certificate_info() {
                pr_svrty_low "not offered"
                fileout "${jsonID}${json_postfix}" "LOW" "--"
           fi
+     fi
      outln
 
      out "$indent"; pr_bold " Certificate Transparency     ";
@@ -23606,6 +23611,10 @@ display_rdns_etc() {
                outln " A record via:          $CORRECT_SPACES supplied IP \"$CMDLINE_IP\""
           fi
      fi
+     if is_ipv4addr "$NODE" || is_ipv6addr "$NODE"; then
+          prln_warning " Warning: IP scan -- Trust, CAA and SNI-dependent checks may be unreliable. Rescan with hostname for accurate results."
+          fileout "ip_scan_warning" "WARN" "Scanning by IP address: Trust, CAA and SNI-dependent checks may be unreliable"
+     fi
      if [[ "$rDNS" =~ instructed ]]; then
           out "$(printf " %-23s " "rDNS ($nodeip):")"
           out "$rDNS"