rec: Ancestor NSEC3s can only deny the existence of a DS

rec: Ancestor NSEC3s can only deny the existence of a DS

Before that commit, the aggressive NSEC(3) cache could have
mistakenly used NSEC3s from the parent zone to prove that a given
name in the child zone did not exist, which is incorrect.
It happened because we did not properly detect that the NSEC3 for
the closest encloser was an ancestor NSEC3 indicating a delegation,
and then in the unlikely but possible case that we found a NSEC3
from the parent zone whose hashes covered the next closer we wrongly
concluded that the name did not exist, returning a NXDomain with an
invalid proof of denial.