fix: usr: Fix deferred validation of unsigned DS and DNSKEY records

When processing a query with the "checking disabled" bit set (CD=1), `named` stores the unvalidated result in the cache, marked "pending". When the same query is sent with CD=0, the cached data is validated, and either accepted as an answer, or ejected from the cache as invalid. This deferred validation was not attempted for DS and DNSKEY records if they had no cached signatures, causing spurious validation failures. We now complete the deferred validation in this scenario.

Also, if deferred validation fails, we now re-query the data to find out whether the zone has been corrected since the invalid data was cached.

Closes #5066

Merge branch '5066-fix-strip-dnssec-rrsigs' into 'main'

See merge request isc-projects/bind9!10104