Rotate a callback endpoint signing key

Creates the next endpoint signing key and selects it immediately for new deliveries while retaining the current key in the receiver acceptance set for a bounded overlap. The overlap defaults to and cannot exceed 24 hours. A second rotation is refused until the current overlap ends. The new secret is returned once to this call, so a call whose answer was never read has rotated a key the caller does not hold. It is recoverable: a signed-in member can read both keys, and the instant the overlap ends, through endpoints.revealSigningSecret. An API credential or an OAuth token cannot, so an integration that loses the answer needs a member to read it back rather than a second rotation, which is refused until the overlap ends. Send If-Match with the version the endpoint was read at to be refused rather than rotate an endpoint that has changed since.