validate: avoid keeping KR_RANK_MISSING

If a sub-query transitions the state to QUERY_DNSSEC_INSECURE,
we didn't set correct rank.  This lead to caching with _MISSING rank
which is too low to be utilized on re-queries.  Example: nix.mx query.