libdnssec: ignore reserved bits in DNSKEY flags

Otherwise Knot Resolver would be breaking a MUST at the very end of https://datatracker.ietf.org/doc/html/rfc4034#section-2.1.1

Real-life example: https://mailarchive.ietf.org/arch/msg/dd/W4lOTgd8-3NF0pbjtqP7YUz6Puk/

src/libdnssec/key/dnskey.c

@@ -64,7 +64,7 @@ int dnskey_rdata_to_crypto_key(const dnssec_binary_t *rdata, gnutls_pubkey_t *ke
 	flags_hi = wire_ctx_read_u8(&wire);
 	wire_ctx_set_offset(&wire, DNSKEY_RDATA_OFFSET_PROTOCOL);
 	protocol = wire_ctx_read_u8(&wire);
-	if (flags_hi != 0x1 || protocol != 0x3) {
+	if (!(flags_hi & 0x1) || protocol != 0x3) {
 		return DNSSEC_INVALID_PUBLIC_KEY;
 	}