'rndc dnssec -checkds published' should force move DS state into rumoured

Similarly, rndc dnssec -checkds withdrawn should force move DS state into "unretentive".

For example, the DS state is in hidden because it is not yet safe to publish the DS, but if the user tells the DS is already in the parent, we should accept that this is the case and update the state accordingly.