export-keyring: Add option to update certificate header

Sometimes the header changes even though the keydata did not. That
happens for example when a key expired or when the way the header is
generated changes (see e.g.
https://lore.kernel.org/tools/20260129100727.950475-2-u.kleine-koenig@baylibre.com/).

Add an option --update-header to write the certificate files in this
case, too.

Caching the result of the new get_header function (e.g. using
functools.cache or functools.lru_cache(maxsize=1)) brings hardly any
runtime advantage in my tests, so I didn't add them.

Link: https://patch.msgid.link/20260225114241.2609196-2-u.kleine-koenig@baylibre.com
Signed-off-by: Konstantin Ryabitsev <konstantin@linuxfoundation.org>