Make return value of ClaimsListShard.getClaimKey() Optional

It was nullable all along, but wasn't tagged as such, and thus it was
possible to misuse the method from its call sites.

Also adds an assertion about no NORDN tasks being enqueued in a failing
domain create test for a required signed mark.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=187649865

java/google/registry/model/tmch/ClaimsListShard.java

@@ -45,6 +45,7 @@ import google.registry.util.SystemSleeper;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.Callable;
 import javax.annotation.Nullable;
 import org.joda.time.DateTime;
@@ -145,8 +146,9 @@ public class ClaimsListShard extends ImmutableObject {
     return creationTime;
   }
 
-  public String getClaimKey(String label) {
-    return labelsToKeys.get(label);
+  /** Returns the claim key for a given domain if there is one, empty otherwise. */
+  public Optional<String> getClaimKey(String label) {
+    return Optional.ofNullable(labelsToKeys.get(label));
   }
 
   public ImmutableMap<String, String> getLabelsToKeys() {