Fix dnssec test
There is a failure mode which gets triggered on heavily loaded
systems. A key change is scheduled in 5 seconds to make ZSK2 inactive
and ZSK3 active, but
named takes more than 5 seconds to progress
rndc loadkeys to the query check. At this time the SOA RRset
is already signed by the new ZSK which is not expected to be active
at that point yet.
Split this into more than one step. Schedule activation 60 seconds in the future, and it should not show up as active. Schedule activation 1 second in the future, wait a second, and it should show up as active.
Closes #1413 (closed)