Concept for wireguard server key rotation

We need a concept to rotate our wireguard server keys.

The rotation should be done in a "rolling" manner, so that wg-users don't lose access to the cluster at some point of time. Instead, there should be some time for wg-users to switch to a new wg-config (with a new server pubkey). During this timeframe, there must be two wireguard endpoints, one with the old and one with the new server key.

After this time, the endpoint with the old key will be shut down.