[9.20.17] fix: usr: Adding NSEC3 opt-out records could leave invalid records in chain

When creating an NSEC3 opt-out chain, a node in the chain could be removed too soon, causing the previous NSEC3 being unable to be found, resulting in invalid NSEC3 records to be left in the zone. This has been fixed.

Closes [#5671](https://gitlab.isc.org/isc-projects/bind9/-/issues/5671)

Backport of MR [!11340](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11340)

Merge branch 'backport-5671-fix-dbiterator-prev-9.20.17' into 'v9.20.17-release'

See merge request isc-private/bind9!892