layer/validate: handle unknown algorithms

i.e. downgrade a zone to insecure when *all* DNSKEYs of the apex are
unverifiable due to unimplemented DNSKEY or DS algorithms.
Fixes https://gitlab.labs.nic.cz/knot/resolver/issues/210
5 jobs from dnssec-unsupported-algos in 6 minutes and 48 seconds (queued for 1 second)
Status Job ID Name Coverage
  Build
canceled #72977
docker linux amd64
build:linux:amd64

passed #27329
docker linux amd64
build:linux:amd64

00:00:26

 
  Test
passed #27331
docker linux amd64
deckard:linux:amd64

00:00:23

canceled #27332
docker linux amd64 allowed to fail
respdiff:linux:amd64

00:06:48

passed #27330
docker linux amd64
test:linux:amd64

00:00:19