3404. [bug] dnssec-signzone: When re-signing a zone, remove
RRSIG and NSEC records from nodes that used to be
in-zone but are now below a zone cut. [RT #31556]
(cherry picked from commit 4b3d727d96)
(cherry picked from commit d8861c4350)
(cherry picked from commit 3314b7cd78)