Send out Lordn during start-date sunrise

Also prevents signed marks from being used in non-sunrise TldStates.

Currently, we send out a Lordn update only when there's a ClaimNotice, or if
we're in end-date sunrise.

But EPPs can contain a SignedMark instead of a ClaimsNotice for trademarked
domains - in which case we aren't sending out Lordn update. This also applies
to start-date sunrises.

We also change the SignedMark behavior for superusers. Currently, if a
mismatched signed mark is given as superuser, we accept it. That causes
problems when we want to send the Lordn update.

Instead - we no longer allow superusers to give a mismatched SignedMark (just
as we don't allow users to give a bad ClaimNotice). A super user can still
create a domain WITHOUT a signed mark - but if one is provided, it must match.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=199783411

docs/flows.md

@@ -522,6 +522,7 @@ An EPP flow that creates a new domain resource.
     *   Service extension(s) must be declared at login.
     *   The current registry phase allows registrations only with signed marks.
     *   The current registry phase does not allow for general registrations.
+    *   Signed marks are only allowed during sunrise.
 *   2003
     *   The provided mark does not match the desired domain label.
     *   Fees must be explicitly acknowledged when creating domains during the