Compute runtime's key manager should be checked

[kostko]

Currently no stateful checks are performed on the registered compute runtime's key manager ID (the only check is that the runtime itself is not also the key manager). Checks are however performed for the genesis document state.

Checks should be added to the RegisterRuntime handler that in case a key manager runtime ID is specified, it must exist and be a valid key manager runtime.

We should also allow explicitly specifying a NULL key manager (e.g., for non-confidential runtimes). (Already part of #2340.)