feat(security)!: remove IEncryptionProvider.RotateKeyAsync overloads

[AbongileBoja]

Summary

4.0 BREAKING — Phase 3c of v4 release. Closes the 3.x deprecation shipped in #137. Both overloads were [Obsolete(error: true)] in 3.x and every shipping implementation (AesEncryptionProvider, AesGcmEncryptionProvider, MigratingEncryptionProvider) threw NotSupportedException. ApiCompat reports CP0001 (member removed) on both.

Removed

• IEncryptionProvider.RotateKeyAsync()
• IEncryptionProvider.RotateKeyAsync(CancellationToken) (the DIM that delegated to the CT-less overload)
• AesEncryptionProvider.RotateKeyAsync implementation
• AesGcmEncryptionProvider.RotateKeyAsync implementation
• MigratingEncryptionProvider.RotateKeyAsync implementation
• 2 reflection-based throw-asserting tests:
  • RotateKeyAsync_Throws_NotSupported in AesGcmEncryptionProviderTests
  • RotateKeyAsync_AlwaysThrows in MigratingEncryptionProviderTests

Migration

Implement key rotation at the storage layer:

1. Construct a new provider with the new key.
2. For each persisted ciphertext: decrypt under the old provider, re-encrypt under the new provider, persist.
3. Cut over reads to the new provider once re-encryption completes.

For MigratingEncryptionProvider specifically, the existing prefix-tag dispatch already supports this pattern — register the previous writer as a legacy reader and promote the new writer.

Local verification

• dotnet build -c Release -p:QUERYSPEC_SKIP_SIGN=true — 0 errors
• dotnet test -c Release — 718 unique tests green across net8.0/9.0/10.0 (was 720; 2 removed)

Phase context — final v4 API break

• Phase 1 ✓ feat(analyzers): ship QuerySpec.Analyzers package with QSPEC0001/2/3 diagnostics and code fixes #153 (Analyzers)
• Phase 2 ✓ feat(core)!: remove 3.x deprecations GeoLocation/AdvancedFilterExpression/ICacheProvider #154 (deprecation removals)
• Phase 3a ✓ feat(efcore)!: convert QuerySpecExpressionTranslator to static class #155 (translator → static class)
• Phase 3b ✓ feat(di)!: remove 11 throwing DI-builder stub methods #156 (DI builder stubs removed)
• Phase 3c ← this PR (Remove obsolete IEncryptionProvider.RotateKeyAsync overloads in 4.0 #138)
• Phase 4 release-engineer — v4.0.0 (next)

Closes #138
Refs #73