Context: coder/coder#9523 (comment)

The current dbcrypt rotation logic

• Requires direct access to the database
• May fail if a coderd instance is still running with the old key and inserts encrypted data when we attempt to revoke the old key.

Moving it to an in-API endpoint would allow for a more ergonomic key rotation process:

• The replica that services the request can validate that it has the correct keys and is not trying to revoke its active key
• The rotation request can now be performed by the slim CLI
• The rotation request can now be performed without direct database access