keymgr: support offline hs_id mode

We'll eventually need to be able to run hidden services in offline hs_id mode.

Some unanswered questions:

• should we be storing the public part of the hsid (KP_hs_id_ in the keystore (or should it be retrieved from somewhere else)?
• if so, should KeyMgr::generate/KeyMgr::generate_with_derived support generating KP_hs_id and KS_hs_id in two different stores?