Slight re-factoring of code for NSEC/NSEC3 creation and updates.
Previously, all NSEC(3) records were first put into a changeset, and later the changeset applied on zone update.
Now, the generated records are put immediately into the zone update structure.
This change itself has no positive impact on performance (rather negative (?)), but simplifies the code and enables further re-designing of whole signing process (getting rid of changesets; doing things more incremental; incremental adjusting).