dnssec-policy now requires inline-signing

Having implicit inline-signing set for dnssec-policy when the zone is not dynamic DNS is confusing, so lets make it explicit.

Closes #3381 (closed), #3385 (closed)