Clean up the IMR DNSSEC validation states

[johanix]

Instead of the current set of booleans (validated, trusted, bogus, trust-anchor):

• create a single ValidationState which is an enum with the possible values Secure, Insecure, Bogus and Indeterminate.
• keep the TrustAnchor as a bool
• If there is a trust anchor then we try to validate, regardless of what the DO and CD bits are set to in the inbound query.