dnssec/nsec3: don't set AD flag in properly signed wildcard nodata answer

3 jobs for fix-oo-wc-nodata
in 1 minute and 12 seconds and was queued for 1 second