FORWARD: don't validate NS in authority section
Fixes #248 (closed) Some (exotic?) resolvers add extra NS records but doesn't provide signatures for them even though we ask with +dnssec +cd. That lead to validation errors. Current example server: 188.8.131.52 Let's not try to validate them when FORWARDing, as we won't most likely need those records anyway (contrary to iteration mode).