new: test: add startup root DNSKEY refresh system test

Root trust anchors are automatically updated as described in RFC5011.
Add a system test which ensures the root DNSKEYs are always queried by
named during startup.

Because this test uses real internet DNS root servers, it is enabled
only when `CI_ENABLE_LIVE_INTERNET_TESTS` is set.

Merge branch 'colin/updaterootdnskey' into 'main'

See merge request isc-projects/bind9!10615