keyring: support prepublishing keys

[tgross]

When a root key is rotated, the servers immediately start signing Workload Identities with the new active key. But workloads may be using those WI tokens to sign into external services, which may not have had time to fetch the new public key and which might try to fetch new keys as needed.

Add support for prepublishing keys. Prepublished keys will be visible in the JWKS endpoint but will not be used for signing or encryption until their PublishTime. Update the periodic key rotation to prepublish keys at half the root_key_rotation_threshold window, and promote prepublished keys to active after the PublishTime.

This changeset also fixes three bugs in periodic root key rotation and garbage collection, none of which can be safely fixed without implementing prepublishing:

• Periodic root key rotation would never happen because the default root_key_rotation_threshold of 720h exceeds the 72h maximum window of the FSM time table. We now compare the CreateTime against the wall clock time instead of the time table. (We expect to remove the time table in future work, ref GC limits > 3 days are in effect infinite b/c of FSM timetable limit #16359)
• Root key garbage collection could GC keys that were used to sign identities. We now wait until root_key_rotation_threshold + root_key_gc_threshold before GC'ing a key.
• When rekeying a root key, the core job did not mark the key as inactive after the rekey was complete.

Ref: https://hashicorp.atlassian.net/browse/NET-10398
Ref: https://hashicorp.atlassian.net/browse/NET-10280
Fixes: #19669
Fixes: #23528
Fixes: #19368

---

Notes for reviewers:

• This is strictly speaking an enhancement but because it's the only way to safely fix the 3 bugs listed (i.e. without orphaning Workload Identities), I'm planning on backporting it to supported Nomad Enterprise versions. Alternately, we could remove periodic key rotation entirely from those older versions and that would "fix" the bug there.
• I'll need to manually backport the docs changes to 1.7.x and 1.6.x CE branches.

[pkazmierczak]

LGTM! Great work! I left some questions/comments, but nothing major.

[schmichael]

CLI comment isn't a blocker but give it a quick think 😁

[github-actions]

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.