Check that DS records are only present at delegations

This extends the integrity check to look for stray DS records
in the zone.

bin/tests/system/masterformat/ns1/example.db

@@ -37,6 +37,7 @@ dnskey			300	DNSKEY	256 3 13 (
 					3uhPJsJ7ivpbh+w==
 					)
 private-dnskey		300	DNSKEY	256 3 253 ( AAo= )
+ds			300	NS	.
 ds			300	DS	30795 1 1 (
 					310D27F4D82C1FC2400704EA9939FE6E1CEA
 					A3B9 )