rndc -checkds halts CDS publication

The new function rndc dnssec -checkds changes the key manager logic such that the DS only becomes RUMOURED when the given rndc command is sent to named. However, this DS state is also used to determine whether the CDS can be published in the child zone.

In other words, the CDS now only gets published once the user said the DS was already in the parent.

This bug is only in development code as the rndc dnssec -checkds did not make the August release and thus the fix will not require a release note.