Reject zones with DS records not at delegations

DS records only make sense at delegations. DS records elsewhere in the zone will invariably there in error.

See #3621

Edited Nov 25, 2022 by Michał Kępień

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information