rec: Only add the NSEC and RRSIG records once in wildcard NODATA answers

rec: Only add the NSEC and RRSIG records once in wildcard NODATA answers

For wildcard-expanded answers we need to collect the proof that the
exact name does not exist and add them to the response. We also
collect that proof for negative answers.
When the answer is a wildcard-expanded NODATA, we only need to collect
them once, not twice.

(cherry picked from commit d89f023d1bd6ae7d0eb6d72e7b2771363f5e4f79)