[9.20] new: test: add startup root DNSKEY refresh system test

Root trust anchors are automatically updated as described in RFC5011.
Add a system test which ensures the root DNSKEYs are always queried by
named during startup.

Because this test uses real internet DNS root servers, it is enabled
only when `CI_ENABLE_LIVE_INTERNET_TESTS` is set.

Backport of MR !10615

Merge branch 'backport-colin/updaterootdnskey-9.20' into 'bind-9.20'

See merge request isc-projects/bind9!10674