[v9_16] dnssec-policy now requires inline-signing

Having implicit inline-signing set for dnssec-policy when there is no update policy is confusing, so lets make this explicit.

(cherry picked from commit 5ca02fe6)

Closes #3381 (closed)