Add a kasp system test that reconfigures a dnssec-policy zone from maintaining DNSSEC records directly to the zone to using inline-signing. Add a similar test case to the nsec3 system test, testing the same thing but now with NSEC3 in use.