Collector next certificate activation should not happen before token validation

Expected Behavior

When a collector connects using a newer certificate the server should not rotate the certificate to the queued, new one before all validations have run.

Current Behavior

In https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog/collectors/opamp/auth/AgentTokenService.java#L118 the rotation happens before the agent's JWT is fully validated. We need to load the correct public key, but should probably not actually rotate until we are happy about accepting the JWT.

Possible Solution

Somehow separate the loading of the next certificate and actually activating it. Currently the keyLoader part also does the rotation, perhaps we can wrap it into an object that either saves the currently active one, or performs a no-op if no rotation was necessary (the most common case).

Context

Came up during review of https://github.com/Graylog2/graylog2-server/pull/27057

Your Environment

• Graylog Version: 7.2.beta-3
• Java Version:
• OpenSearch Version:
• MongoDB Version:
• Operating System:
• Browser version:

Checklist

[] This issue fix need to be backported. [] Does this issue have security implications?