shadow CI: Add a couple of tests involving C Tor keystores
This adds a new shadow test where an arti client (using restricted discovery keys read from a C Tor keystore) connects to an arti hidden service (that reads its identity key from a C Tor keystore).
Follow-up from !2481 (merged)