layer/validate: clear AD if closest encloser proof has optouted NSEC3

3 jobs for fix-noname-oo
in 1 minute and 17 seconds and was queued for 4 seconds