1.3.17 enforcer issue port

Port of fixes for issues OPENDNSSEC-588, 589, and 579. Also updates to policy tests and NEWS. Should only need review by RM.