validate: work around some SERVFAILs (iterating mode)

- This affects the iterating mode only (except for a verbose message).
- The problem was introduced when implementing forwarding in 651c5aad.
- Example that was affected: *.org.ru.

When the same server is authoritative for multiple consecutive zones,
with a higher one being signed and a lower one being unsigned, we may
get an unsigned answer even in case we *think* we're currently in a
signed zone.

In particular, DS (sub-)queries are important because of being used to
prove the insecurity of zones - in that case the iterator can correctly
determine the (unexpected) zone name from which the answer came, due to
seeing the SOA record, but that is too late for zone_cut_check() to try
getting a trust chain to it, so we need to YIELD for it to do it.
5 jobs for org.ru in 1 minute and 1 second
Status Job ID Name Coverage
  Build
canceled build:linux:amd64 #73057
amd64 linux docker

passed build:linux:amd64 #13781
docker linux amd64

00:02:33

 
  Test
passed deckard:linux:amd64 #13783
docker linux amd64

00:01:01

canceled respdiff:linux:amd64 #13784
docker linux amd64 allowed to fail

passed test:linux:amd64 #13782
docker linux amd64

00:00:35