[9.20] fix: usr: rndc sign during ZSK rollover will now replace signatures

When performing a ZSK rollover, if the new DNSKEY is omnipresent, the :option:`rndc sign` command now signs the zone completely with the successor key, replacing all zone signatures from the predecessor key with new ones.

Closes #5483

Backport of MR !10867

Merge branch 'backport-5483-smooth-operator-bug-9.20' into 'bind-9.20'

See merge request isc-projects/bind9!11017