Extend tests for signed, CNAME-sourced delegations

Extend tests for signed, CNAME-sourced delegations

Extend the "chain" system test with AUTHORITY section checks for signed,
secure delegations.  This complements the checks for signed, insecure
delegations added by commit 82b7e6ccefd902a673aa3ed6a51e169da2411677.

Extend the existing AUTHORITY section checks for signed, insecure
delegations to ensure nonexistence of DS RRsets in such responses.
Adjust comments accordingly.

Ensure dig failures cause the "chain" system test to fail.

(cherry picked from commit a14efdf54cc09165093f2938cafe32a331574a4d)