rec: Fix the gathering of denial proof for wildcard-expanded answers

rec: Fix the gathering of denial proof for wildcard-expanded answers

If somehow the RRSIG indicating that the answer is expanded from a
wildcard (label count smaller than the number of labels in the name)
went _after_ the NSEC we need, we forgot to gather that NSEC.
It might have been an issue for downstream validation (we do gather
them a second time later for our own validation) since the client
would not have received them.