DNS_R_MUSTBESECURE failures

1. a DNS_R_MUSTBESECURE is overwitten (clang error report)
2. validator_done() called twice with DNS_R_MUSTBESECURE then ISC_R_SUCCESS (by inspection of mustbesecure handling from 1.)