Don't fall into PKIX mode in error.

When no usage PKIX-TA(0)/PKIX-EE(1) TLSA records are specified,
failure to match any usage DANE-TA(2)/DANE-EE(3) records would fall
through to non-DANE PKIX validation.  We now enforce that at least
one PKIX TLSA record mantches when no DANE TLSA RRs do (even when
no PKIX TLSA RRs defined).

Adjusted tests accordingly.