Add the 'CSK' (Combined Signing Key) nomenclature

Add the 'CSK' (Combined Signing Key) nomenclature

This commit removes the 'keyOrZone' boolean from
DNSSECKeeper::KeyMetaData and adds 'keyType' enum to it that can contain
one of 3 values (KSK, ZSK or CSK). A key is marked as a CSK when there
is no other key with the same algorithm for the zone, and if there is
another key, that it does not have a different SEP-bit set.

By default, we now also set the SEP-bit in `pdnsutil secure-zone` when
only a ZSK is created (this is the default) so we comply with the
recommendation in RFC 6781 §3.2.3.

Closes #3194