offline KSK: validate SKR RRSIGs before import

src/knot/dnssec/kasp/kasp_zone.c

src/knot/dnssec/kasp/kasp_zone.h

src/knot/dnssec/key_records.c

src/knot/dnssec/key_records.h

src/knot/dnssec/zone-sign.c

src/knot/dnssec/zone-sign.h

src/utils/keymgr/offline_ksk.c