Rotate an online key (requires re-signing of role metadata)

Coming from META: Rotate (off-line) root keys (#164 - closed), and Add a "runbook" for the ceremony to update a re... (#166 - closed) if (and only if) we change a non-root (ie. "online") key, we will need to adapt the new deploy-root-metadata command to:

• Re-sign any affected metadata (only in the context of rugged deploy-root-metadata): (Follow similar logic to refresh-expiry)
  • ask each worker whether it has metadata that require re-signing
    • Check that each metadata file's signatures remain valid (ie. the keyid of each signature can be found in the Root "roles" entry for this metadata's role.)
      • If yes, return (ie. proceed to the next metadata file)
      • If no, add it to the list of metadata that needs a refresh.
  • trigger a "refresh-expiry" on the metadata returned from the previous step (btw/ this already updates expiry and re-signs the metadata. We don't have to change the logic, and the content hashes don't have to be changed)
• Add end-to-end test for this process (including initializing the repo) and validating final resulting repo.
• runbooks need to update:
  • GENERATE-ONLINE-KEYS (updates config and?) uses generate-online-key command
  • INITIALIZE-PARTIAL-ROOT-METADATA-FOR-UPDATE uses remove-verification-key and add-verification-key
  • UPDATE-TUF-REPO uses deploy-online-key immediately after deploy-root-metadata to ensure new online keys are in place at the same time as new root metadata makes them valid
• Update Key rotation background page: https://rugged.works/background/ceremonies/key-rotation#generate-online-keys

rugged generate-keys will look at the list of keys in config, and generate any that are missing, but this will result in them being available to the repository, even though they aren't yet valid.