fix: usr: Reject unsupported RSA DNSKEY shapes during DNSSEC validation

An authoritative server publishing an RSA DNSKEY with an unusually
large modulus or an exotic public exponent could make each DNSSEC
signature check on a validating recursive resolver noticeably more
expensive than for a normally sized key.  Such DNSKEYs are now
treated as invalid.

Closes #6008

Merge branch '6008-reject-oversized-rsa-dnskeys' into 'main'

See merge request isc-projects/bind9!12054