_SECURE and _INSECURE weren't real flags, as their setting was
logically exclusive of the "values".  That made changing ranks rather
cumbersome.

Tests: val_cname_to_unsigned_fake_rrsig gets broken, but I hope this
change just uncovered a hidden bug.