Convert going insecure kasp test to pytest

Convert going insecure kasp test to pytest

When going insecure, we publish CDS and CDNSKEY DELETE records. Update
the check_apex function to test this.

Also, skip some tests in the 'check_rollover_step()' function. If
we change the DNSSEC Policy, keys that no longer match the policy will
be retired. When this exactly happens is hard to determine, as it
happens on the reconfigure. So for these tests, we skip the key timing
metadata checks.

Also, the zone becomes unsigned, so don't call 'check_zone_is_signed'
in those cases.

(cherry picked from commit b1d8217d1a39f798983152345f29c48ffa2427f9)