dnssec nsec3

[hannesm]

from RFC: if a nsec3 entry the flags field set to something unknown, this nsec3 record should be ignored.
what we do is ignoring it manually in dnssec.ml (in nsec3_rrs we check or flags being none or some opt_out). what should be done is the same in slightly more type-safe way.