DNSSEC: only managed records should be protected in DDNS code

The DDNS code prevents touching any DNSSEC related records with the exception of DS. However, only automatically managed records should be protected. DNSKEY or NSEC3PARAM outside zone apex is not practically a DNSKEY record and should not be protected by DDNS code.