Update optout test to reconfig to NSEC

Update optout test to reconfig to NSEC

If we change from NSEC3 to NSEC we should not produce a zone with
missing NSEC records.

The code only considered having seen a record if there was previously
a signature present at the owner name. However with opt-out, insecure
delegations don't have a RRSIG record. Reconfiguring to NSEC causes
all insecure delegations to have a missing NSEC record.

Add a DNAME record to the test zone to also cover DNAME delegations.

(cherry picked from commit 3679bd48885273819c02341ff0392c7a54c4b668)