Return Refused when we are not forwarding a packet.
Add correct handling of DNSSEC records in rfc2136

Ignore NSEC or NSEC3 records, as they are never stored in the records table.
Allow adding/removing/updating of NSEC3PARAM's