validate: wildcard expansion -> adjust to_wire

We pushed all authority to the wire, but that was unnecessary,
and in particular it clashed with not validating NS in authority when
forwarding (new change).  Let's only apply this to NSEC* RRs.
10 jobs for <span class="ref-name">forward-unsigned-NS</span> in 5 minutes and 41 seconds (queued for 3 seconds)
Status Job ID Name Coverage
  Build
passed #74174
docker linux amd64
build:linux:amd64

00:03:16

canceled #73147
docker linux amd64
build:linux:amd64

passed #52660
docker linux amd64
build:linux:amd64

00:00:29

canceled #72984
docker linux amd64
build:linux:amd64

passed #73327
docker linux amd64
build:linux:amd64

00:05:26

 
  Test
canceled #73231
docker linux amd64
deckard:linux:amd64

passed #52664
docker linux amd64
respdiff:linux:amd64

00:02:24

passed #52661
docker linux amd64
test:linux:amd64

00:00:27

passed #52663
docker linux amd64
test:linux:amd64:valgrind

00:00:55

passed #52662
docker linux amd64
deckard:linux:amd64

00:03:45