layer/validate: handle unknown algorithms

i.e. downgrade a zone to insecure when *all* DNSKEYs of the apex are
unverifiable due to unimplemented DNSKEY or DS algorithms.
Fixes https://gitlab.labs.nic.cz/knot/resolver/issues/210
5 jobs for dnssec-unsupported-algos
in 6 minutes and 48 seconds and was queued for 1 second