[9.21.16] fix: usr: Adding NSEC3 opt-out records could leave invalid records in chain

When creating an NSEC3 opt-out chain, a node in the chain could be removed too soon, causing the previous NSEC3 being unable to be found, resulting in invalid NSEC3 records to be left in the zone. This has been fixed.

Closes isc-projects/bind9#5671

Backport of isc-projects/bind9!11328

Merge branch '5671-fix-dbiterator-prev-9.21.16' into 'v9.21.16-release'

See merge request isc-private/bind9!891