Handle disabled keys and otherwise unusable user IDs/keys

This adds a better error than "No matching certificates or groups found"
for user IDs/keys that are neither revoked nor expired but that are
unusable/filtered out for some other reason. Since CertificateLineEdit
cannot know all reasons why a certificate is filtered out we use an
unspecific Unusable status. An example for an Unusable user ID/key is a
key with revoked encryption subkey.

• GnuPG-bug-id: T7789