federation: notary (batched) key query support

See: https://spec.matrix.org/unstable/server-server-api/#post_matrixkeyv2query

I just cannot seem to figure out why minimum_valid_until_ts is applied to individual key IDs since Conduit holds one (Server)SigningKey with one valid_until_ts value for all its verify_keys. Synapse also attempts to query trusted servers if the requested keys can't be found locally or is halfway past its validity interval, but I'm not sure if we wanna adapt the same behavior.