validate: avoid DNSSEC_NODS for . DS queries

... after the parent commit. Perhaps it can't cause trouble,
but I'll feel safer this way.
18 jobs for marek/fix-servfails-for-root-ds
in 8 minutes and 15 seconds and was queued for 12 seconds