resolver: add missing . NS signatures to val_nsec3_optout_unsec_cache

There is a trick:
Original answer to query `. NS` contains a lot of NS names which are not
interesting for the test itself. The additional section supplies just
single IP address and the test does not contain root-servers.net. domain
and related infrastructure. This works with current kresd but might
break in future if kresd starts to require all names (or IPv6 or so).
11 jobs for master
in 1 minute and 42 seconds and was queued for 1 second