Sync RPKI Trust Anchor constraints to nro-delegated-stats

Sync RPKI Trust Anchor constraints to nro-delegated-stats

Turns out that registry at https://www.iana.org/assignments/as-numbers/as-numbers.xml
is an incomplete one, where only 'new' assignments are listed. In the
past this registry used to list all ASNs, but the RIRs asked IANA to
revert to not being very detailed...

There is another source of truth, the 'nro-delegated-stats' file at
https://ftp.ripe.net/pub/stats/ripencc/nro-stats/latest/nro-delegated-stats
this is updated daily and composed of information from each RIR.

Summary of changes:

* LACNIC manages a more ASNs than previously known:
  - allow those ASNs for LACNIC
  - deny those for RIPE, APNIC, ARIN

* AFRINIC's allow list was good (compared to nro-delegated-stats), but the
  full set of AfriNIC ASNs wasn't denylisted for RIPE, ARIN, APNIC.

OK tb@