No, unbound is not an authoritative server, and doesn't have all the
authoritative DNS capabilities (you could run a real auth server and
point a stub-zone at it).
What you want can be done with
local-zone: "ls.local" redirect
local-data: "ls.local 86400 IN A 192.168.2.30"
It replies with 192..30 for ls.local and everything below.
Including a.b.c.*.ls.local... So more than a wildcard would, but anyway
an academic difference to you, no doubt.