REL-2099: policy/trpcclient fix for locked keychain

One of the side-effects of removing the reliance on the Java sandbox is that the keychain is consulted more often than before, and in some of these cases a locked keychain is acceptable and should be interpreted as if it were empty. In these cases `unsafeRunAndThrow` is not appropriate because it promotes `KeyFailure.KeychainLocked` to an exception. This PR addresses the two known cases: one discovered by Andy in `TrpcClient` construction, and one in `ImplicitPolicy` which was fixed in #87 but is improved here.