DNSSEC: ipa-dnskeysyncd: Skip zones with old DNSSEC metadata in LDAP
    
    This filtering is useful in cases where LDAP contains DNS zones which
    have old metadata objects and DNSSEC disabled. Such zones must be
    ignored to prevent errors while calling dnssec-keyfromlabel or rndc.
    
    https://fedorahosted.org/freeipa/ticket/5348
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>
    Reviewed-By: Martin Basti <mbasti@redhat.com>