Check unsigned serial number in signed zone files

All signed zone files present in bin/tests/system/inline/ns8 should contain the unsigned serial number in the raw-format header. Add a check to ensure that is the case. Extend the dnssec-signzone command line in ns8/sign.sh with the -L option to allow the zones initially signed there to pass the newly added check. Add another zone to the configuration for the ns8 named instance to ensure the check also passes when multiple zones are inline-signed by a single named instance.

(cherry picked from commit ab49205a)

Closes #3071 (closed)