resolve: use different bitmap checking rules when we find an exact NSEC3 match, or...

resolve: use different bitmap checking rules when we find an exact NSEC3 match, or just a covering enclosure

If we are looking for a DS RR we need to check the NSEC3 bitmap of the parent zone's NSEC3 RR, not the one from the
child. For any other RR we need to look at the child's however, hence enforce this with the bitmaps.

Note that not coverign checks only the lower zone's NSEC3 bitmaps matter, hence the existing check is fine.