add test for ent which is only derived from an insecure delegation
add .bind zones to .gitignore
pdnssec: fix ent generation for insecure delegations
AXFR-in: fix ent generation for insecure delegations
allow covering NSEC3 record in NODATA response
workaround for ldns-verify-zone bug in regression tests