Rotate callback signing secret

Generates a new callback signing secret and returns it. Callbacks delivered after rotation are signed with the new secret, so update your verifier promptly (there is no dual-secret window).