[v9_9] fix incorrect nsec3 check

[v9_9] fix incorrect nsec3 check

    - check for NSEC3 in empty nodes when not due to optout delegations
    - fixed typo in output ("Bad record NSEC record")
    - incidentally fixed an error in signzone that caused an
      incorrect warning about missing DNSKEYs when using -S
      and -3 together

3473.	[bug]		dnssec-signzone/verify could incorrectly report
			an error condition due to an empty node above an
			opt-out delegation lacking an NSEC3. [RT #32072]
(cherry picked from commit 9a0dd99a757c469d9530acd5cb11789b3b0af5ce)