list "validate-except" entries in "rndc nta -d" and "rndc secroots"

list "validate-except" entries in "rndc nta -d" and "rndc secroots"

- no longer exclude these entries when dumping the NTA table
- indicate "validate-except" entries with the keyword "permanent" in
  place of an expiry date
- add a test for this feature, and update other tests to account for
  the presence of extra lines in some rndc outputs
- incidentally removed the unused function dns_ntatable_dump()
- CHANGES, release note