Fixture for issue #13: the missing-glue policy check.

missing-glue.zone is unsigned (glue presence is a zone-structure property,
independent of DNSSEC) and covers each branch of the check:

  del1  NS ns1.del1        in-bailiwick, no A/AAAA anywhere   -> reported
  del2  NS ns.example.net. out of bailiwick                   -> not checked
  del3  NS ns1.del3        AAAA glue present                  -> fine
  del4  NS del4            target equals the delegation owner,
                           A record at the owner itself       -> fine

The occluded-records policy is also quiet on this zone (glue records are
referenced by their own delegations; del4's A record sits at the cut, not
below it), which the -p all assertion relies on.

Every delegation carries two NS records so that -p all stays free of
single-ns noise.  No regeneration needed; the zone is committed as-is.
