dnssec/zone_update: zone sign bumps SOA serial only if not updated yet

this bug bahaves like this: if you configure: dnssec-signing: on zonefile-load: difference it will, upon changing zonefile, make inconsistencies in journal leading in broken IXFR

the reason is that by calling set_new_soa over existing SOA in changeset (probably because of zone_update_from_differences) it updates the changeset's soa_from to incorrect value