chg: usr: Reject oversized and malformed DNSKEY records up front

Oversized RSA key material in a DNSKEY record was only rejected
after it had been converted, allocating memory proportional to
the record size. Such records are now rejected before conversion,
as are Ed25519 and Ed448 keys with trailing bytes that were
previously silently ignored.

Closes #4537

Merge branch '4537-reject-oversized-DNSKEYs' into 'main'

See merge request isc-projects/bind9!12544