Return the maximum permitted KASP key tag

Return the maximum permitted KASP key tag

DNSSEC tools read the minimum tag for both bounds of a policy's key tag
range, so generated keys could be accepted outside the configured
range. Return the correct bound and assert the collision check's range
contract so invalid bounds fail instead of disabling validation.