Full KES Agent Integration

🧑‍⚖ Represents items requiring stakeholder decisions.

- [x] Locked KES and DSIGN primitives
- [x] `cardano-base:cardano-crypto-class`
- [x] Networking: `RawBearer`
- [x] Direct serialization
- [x] `cardano-base`
- [x] `ouroboros-network`
- [x] Use mlocked KES / DSIGN in `ouroboros-consensus`
- [x] Facilitate secure key deletion
- [x] Move opcerts into HotKey
- [x] Prepare `LeaderCredentials` to take a "recipe" for obtaining a KES SignKey, rather than the key itself.
- [x] Set up block forging threads for hot-swapping KES keys and correctly managing their ownership and lifecycles.
- [ ] KES Agent
- [x] Library
- [x] Control client
- [x] Example service client
- [x] Add KES agent connectivity to `ouroboros-consensus`
- [x] Split Serdoc stuff in `kes-agent` into a separate sub-library
- (not strictly "into a separate sub-library", but we no longer depend on SerDoc from consensus)
- [x] Release `undefined` version of `kes-agent` to CHaP (https://github.com/IntersectMBO/ouroboros-consensus/issues/1580)
- [x] ~~https://github.com/IntersectMBO/ouroboros-consensus/pull/1487~~
- [x] https://github.com/IntersectMBO/ouroboros-consensus/pull/1620
- [x] Code audit
- [x] Release non-`undefined` `kes-agent` library to CHaP
- [ ] Address open questions:
- [ ] https://github.com/input-output-hk/kes-agent/issues/39
- [ ] https://github.com/input-output-hk/kes-agent/issues/40
- [ ] ~~Add TCP as an alternative to domain sockets ([#42](https://github.com/input-output-hk/kes-agent/issues/42))[^2]~~.
- [x] Merge `ouroboros-consensus` KES agent integration PR with stubbed out `kes-agent` (#1620)
- [ ] Integrate new `ouroboros-consensus` version with `cardano-api`
- [ ] https://github.com/IntersectMBO/cardano-api/pull/884
- [ ] Integrate new `ouroboros-consensus` version with `cardano-node`[^1]
- [ ] https://github.com/IntersectMBO/cardano-node/pull/6266
- [ ] Add new integration tests
- [ ] KES agent setup improvements (Make KES agents easier to set up, potentially by providing ready-to-use images for Docker containers).
- Deployment
- [ ] Demo working system to (some) SPOs
- [ ] Gather and address feedback
- [ ] Limited field test
- [ ] Roll out as an optional feature
- [ ] ~~Gauge adoption~~
- [ ] ~~Eventually: Make KES agents mandatory~~

[^1]: This will mostly be a matter of changing how configuration is loaded on startup, to match the new configuration structure of `ouroboros-consensus`.
[^2]: This would require adding authentication and encryption features to KES agent itself, which might take 3 to 6 months.