fix: usr: Honor DNSSEC policy key tag ranges

When a DNSSEC policy configured a non-default tag-range, dnssec-keygen
and dnssec-ksr could accept generated keys outside that range. Both tools
now honor the configured minimum and maximum key tags.

Closes #6091

Merge branch '6091-fix-dns-kasp-key-tagmax' into 'main'

See merge request isc-projects/bind9!12539