Convert enable dnssec test case to pytest

Convert enable dnssec test case to pytest

Move the 'enable-dnssec' to the rollover test dir and convert to pytest.

This requires new test functionality to check that "CDS is published"
messages are logged (or prohibited).

The setup part is slightly adapted such that it no longer needs to
set the '-P sync' value in most cases (this is then set by 'named'),
and to adjust for the inappropriate safety intervals fix.

(cherry picked from commit 233fdb8d520bda11fe18efe9c14e36930e6e96b0)