Resolve "TLS settings for primaries not saved for catalog zone entries." [v9_18]

Extract the tlss values if present from the ipkeylist entry and add the resulting tls setting to the constructed configuration for the primary.

When comparing catalog zone entries for reuse also check the masters.tlss values for equality.

Backport of !7010 (merged)

Closes #3638 (closed)