Atomically revoke one owned key and return its replacement exactly once.

Costs nothing quota-wise. The replacement keeps the old key's name and scopes; the old credential stops authenticating as soon as this call commits. Recover from not_found by listing keys and using an active owned id, from scope_missing with an owner-authorized key, and from rate_limited or service_unavailable by waiting retry_after_sec before retrying once.