Make return value of ClaimsListShard.getClaimKey() Optional

It was nullable all along, but wasn't tagged as such, and thus it was
possible to misuse the method from its call sites.

Also adds an assertion about no NORDN tasks being enqueued in a failing
domain create test for a required signed mark.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=187649865

java/google/registry/flows/domain/DomainFlowUtils.java

@@ -934,7 +934,8 @@ public class DomainFlowUtils {
   static void verifyClaimsNoticeIfAndOnlyIfNeeded(
       InternetDomainName domainName, boolean hasSignedMarks, boolean hasClaimsNotice)
       throws EppException {
-    boolean isInClaimsList = ClaimsListShard.get().getClaimKey(domainName.parts().get(0)) != null;
+    boolean isInClaimsList =
+        ClaimsListShard.get().getClaimKey(domainName.parts().get(0)).isPresent();
     if (hasClaimsNotice && !isInClaimsList) {
       throw new UnexpectedClaimsNoticeException(domainName.toString());
     }