[v9_16] Document where updates and DNSSEC records are stored

Make clear that inline-signing stores DNSSEC records in a signed version of the zone, using the zone's filename plus ".signed" extension.

Tell that dynamic zones store updates in the zone's filename.

DNSSEC records for dynamic zones also go in the zone's filename, unless inline-signing is enabled.

Then, dnssec-policy assumes inline-signing, but only if the zone is not dynamic.

(cherry picked from commit 8860f6b4)

Closes #3397 (closed)