rec: Prevent a race in the aggressive NSEC cache

rec: Prevent a race in the aggressive NSEC cache

When a new NSEC3 record has a different salt than the one we know, we
update the zone entry with the new salt. Unfortunately, that salt was
read without holding the lock in `AggressiveNSECCache::getNSEC3Denial`,
leading to a possible data race.

(cherry picked from commit 779f35b41c758bed9215d51df4fc3a69edbada9d)