Add NSEC3 whitelies

This is only the first part, this just denies the qname.
Closest encloser and the wildcard NSEC3 are not generated (yet)
Add some stuff for NSEC3 testing later