fix: usr: Fix DNSSEC validation failures for names under an apex DNAME

DNSSEC validation could fail with SERVFAIL for names covered by a DNAME
at the apex of a signed zone, unless the zone's keys were already validated
in the cache. This regression was introduced by the recent fix for resolver
stalls on CNAME responses to DS queries.

Closes #6176

Merge branch '6176-validator-apex-dname' into 'main'

See merge request isc-projects/bind9!12353