DNSSEC: allow public-only KSK in READY state (CDS published)

src/knot/dnssec/ds_query.c

src/knot/dnssec/key-events.c

src/knot/dnssec/zone-keys.c

src/knot/dnssec/zone-keys.h

src/knot/dnssec/zone-sign.c

...dnssec/key_rollovers/data/public-only-ECDSAP256SHA256.key

...dnssec/key_rollovers/data/public-only-ECDSAP384SHA384.key

tests-extra/tests/dnssec/key_rollovers/test.py