* plugin/dnssec: check validityperiod of RRSIGs

Somehow we missed implementing this. If a sig a retrieved from the
cache, but not valid anymore, regenerate it instead of server invalid
signatures.

Fixes #1378

* drop from cache after 3/4 validity

* six days means 6 days