ctl/zone-ksk-submitted: avoid deadlock on DNSSEC event when frozen...

knotc zone-ksk-submitted actually triggers two operations:
1) modification of KSK's metadata
2) re-signing of the zone when called in multithreaded CTL, it might happen
   that knotc zone-begin arrives between those and if a third comand needs
   to lock it all, it could cause deadlock