lib/zonecut: fetch root DNSKEY from cache correctly

previously it was always overwritten with SBELT for root + root TA
doesn't have to be in cache (it's in trust store)