validate: wildcard expansion -> adjust to_wire

We pushed all authority to the wire, but that was unnecessary,
and in particular it clashed with not validating NS in authority when
forwarding (new change).  Let's only apply this to NSEC* RRs.
10 jobs for forward-unsigned-NS in 5 minutes and 41 seconds (queued for 3 seconds)
Status Job ID Name Coverage
  Build
passed #74174
amd64 linux docker
build:linux:amd64

00:03:16

canceled #73147
amd64 linux docker
build:linux:amd64

passed #52660
docker linux amd64
build:linux:amd64

00:00:29

canceled #72984
amd64 linux docker
build:linux:amd64

passed #73327
amd64 linux docker
build:linux:amd64

00:05:26

 
  Test
canceled #73231
amd64 linux docker
deckard:linux:amd64

passed #52664
docker linux amd64
respdiff:linux:amd64

00:02:24

passed #52661
docker linux amd64
test:linux:amd64

00:00:27

passed #52663
docker linux amd64
test:linux:amd64:valgrind

00:00:55

passed #52662
docker linux amd64
deckard:linux:amd64

00:03:45