Don't roll offline keys

Don't roll offline keys

When checking the current DNSSEC state against the policy, consider
offline keys. If we didn't found an active key, check if the key is
offline by checking the public key list. If there is a match in the
public key list (the key data is retrieved from the .key and the
.state files), treat the key as offline and don't create a successor
key for it.

(cherry picked from commit 3e6fc49c165c203b3d2c3c58b93bcb18d18fcf40)