Use same DNSKEY handling for AXFR queries as for DNSKEY queries

* AXFR is ordered manually; group DNSKEYs (needed for RRSIGs)
* only pull DNSKEY records from backend if DNSKEY query would have done it too
  (no private keys or KSK offline or experimental-direct-dnskey=yes)
* ANY still always adds DNSKEY records from backend