Rotate the DataHub secret-service encryption key

Generates a fresh SECRET_SERVICE_ENCRYPTION_KEY (the key GMS uses to encrypt ingestion source credentials and other sensitive values at rest), re-encrypts every stored secret from the old key to the new one, and then restarts GMS on the new key. Because the stored secrets are migrated in place, ingestion resumes on its own after the restart. USER-VISIBLE SIDE EFFECT: none for API tokens or browser sessions. Ingestion pauses only for the duration of the GMS restart and then continues.