Fix race condition in salt-key

salt-key passes on the match glob to the applicable function within
salt.key.Key. However, if the glob includes a wildcard (or the argument
passed was -A/-D/-R, which executes the add/delete/reject on '*'), then
if there is any key activity between when the confirmation prompt
appears and when 'Y' is chosen, the wildcard could match one of the new
keys, resulting in unexpected actions being taken.

This commit changes the CLI usage of salt-key so that it passes a
dictionary of matching keys to the applicable function within
salt.key.Key. API backwards compatibility is preserved, because when
these pre-compiled dictionaries of keys are passed, they are passed in a
different argument name.

Fixes #7304.