Detach an org SSH key from a VM

Removes the key from the VM's allowed set. Detaching a key that is not attached is a no-op (204). The last attached key cannot be detached: an empty set would widen access to every org key (the org-wide fallback), so that returns 400.