[9.16] Merge branch '3673-delay-trust-anchor-management' into 'main'

it was possible for a managed trust anchor needing to send a key refresh query to be unable to do so because an authoritative zone was not yet loaded. this has been corrected by delaying the synchronization of managed-keys zones until after all zones are loaded.

Backport of MR !7441 (merged)

Closes #3673 (closed)