A lot of changes here... will annotate all of them inline. Here are the big things:
- consolidated getPrimaryOneTimeKeys and getNotificationsOneTimeKeys into a single API, getOneTimeKeys
- make sure we only generate one-time keys if we don't have enough unpublished one-time keys
- rename CryptoModule::getOneTimeKeys to CryptoModule::getOneTimeKeysForPublishing so that it's clear to the caller that the returned keys should be published immediately