DNSSEC/scheduling: Moved zone sign planning outside of RCU

- Reasoning: If the signing event is running in a concurrent thread, code started by reload will try to cancel it, but it can't since it's running *and* it is waiting for RCU unlock. If we move the planning after RCU critical section, the deadlock will not occur, but Knot will serve the zone created by previously planned signing event, not by the reload. Nothing I can do about this now, we have a fix planned for future version.

Refs #157