nsec3: bugfix: empty-non-terminal above unchanged deleg has NSEC3:

this happens when an incremental update removes a record from a node, which becomes empty-non-terminal, and there is a delegation below the node. In this situation, NSEC3 record for this empty-non-terminal was created, which is not against RFCs, but inconsistent with general Knot behaviour. The fix always iterates to a subtree of empty-non-terminal with mark_empty on incremental update.