Backport

This PR is auto-generated from #23528 to be assessed for backporting due to the inclusion of the label backport/1.15.x.

The below text is copied from the body of the original PR.

This PR implements a hopefully simple fix where Vault wouldn't reprioritize credentials when the rotation period was changed. Tests are incoming, but I wanted to get some thoughts on a question below:

The question that invites some bikeshedding is how to update the 'next rotation time' period -

Right now, I am doing the simplest case - take the current time, add the rotation period. This is easy to understand, but if, say someone updates a 30 day rotation to a 45 day rotation, could result in a rotation period (just this once) that is much longer than expected.

Another way would be to update the next rotation time to be "as though" it was with the new rotation period, e.g., if you update a 30d period to 45d, we would add only 15 days. If you lowered the rotation period to 20d, we would subtract 10 days. This could result in a priority in the past, which might be unexpected, but would be programmatically fine - the credential would simply rotate the next time the queue is checked.

There are also hybrid approaches possible, of course, trading off complexity with trying to do "what people would want".