Branch rt46468 fixes both issues mentioned above and disassociates
clearing the DNS_ZONEFLG_REFRESHING flag from fetch creation failures.
We already missed two scenarios which cause a "deadlock" in RFC 5011
code, so I hope that with an additional countermeasure in place we will
no more have to trust that the key processing loop in zone_refreshkeys()
is definitely free of any further bugs.  This change may cause some busy
looping [1] in case there are any other similar errors out there, but
that is arguably better (and easier to detect) than stopping RFC 5011
cold.  Please review.

I could not come up with a reliable way to trigger any of the issues
fixed by rt46468 and thus no system tests were added to it.

[1] Caused by zone_refreshkeys() not resetting the key refresh timer:

        02-Nov-2017 15:17:03.995 zone_maintenance: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_refreshkeys: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_settimer: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_timer: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_maintenance: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_refreshkeys: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_settimer: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_timer: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_maintenance: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_refreshkeys: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_settimer: managed-keys-zone : enter
        02-Nov-2017 15:17:03.995 zone_timer: managed-keys-zone : enter