chg: usr: Implement RFC 3645 Section 4.1.1 key expiry check in TKEY

Check for existing TSIG keys before accepting a new
GSS-API negotiation and delete the key if it has expired.
Previously, an expired GSS key would permanently block
re-negotiation for that name until the server was restarted.

Merge branch 'ondrej/cleanup-gssapi-and-tkey-api' into 'main'

See merge request isc-projects/bind9!11713