to work even if signing takes longer time

new timers system:

created - ( pre_active ) - published - (ready) - active -
(retire_active) - [ retire | post_active ] - remove

ksk rollover:
 - now uses new retire_active for things to settle up after submission
 - CSK/CDNSKEY are always generated for the best active key (except for
imported keys)

mostly refactoring of zone load event

...to avoid signing the same serial twice differently
forcing increment of serial if the same master serial signed twice

...are now 257 for CSK

1) fixed comments
2) unreachable code in knotc
3) knotc --help zone-ksk-submitted

to avoid too big difference between zones sharing the key