Add a test case for migrating CSK to dnssec-policy. The keymgr has no way of telling that the key is used as a CSK, but if there is only one key to migrate it is going to assume it must be a CSK. (cherry picked from commit 96ee323622)
96ee323622