libdnssec: ignore reserved bits in DNSKEY flags

Otherwise Knot Resolver would be breaking a MUST at the very end of https://datatracker.ietf.org/doc/html/rfc4034#section-2.1.1

Real-life example: https://mailarchive.ietf.org/arch/msg/dd/W4lOTgd8-3NF0pbjtqP7YUz6Puk/

added bug libraries labels

On a signer this check would be suitable, I believe, as that RFC paragraph says

these bits MUST have value 0 upon creation of the DNSKEY RR

but this part of code is shared with Knot Resolver's validator, too. (and I'm not sure about other cases like secondaries)

So a check for this might be added on a different place that is signer-specific.

merged

mentioned in commit 23c4cc8f