Add kasp test policy goes straight to "none"

Add kasp test policy goes straight to "none"

Add a test case when a dnssec-policy is reconfigured to "none",
without setting it to "insecure" first. This is unsupported behavior,
but we want to make sure the behavior is somewhat expected. The
zone should remain signed (but will go bogus once the signatures
expire).

(cherry picked from commit 287428e0aa2f426f8b248dd68e4497aea093d19b)