tests-extra: no_resign: Only allow RRSIGs for SOA and NSEC