keyset move all apex records into a single state variable

[Philip-NLnetLabs]

• move dnskey_rrset, cds_rrset, ns_rrset into apex_extra (ds_rrset remains).
• add apex_remove with a list of Rtypes that the signer should remove from the apex.