Rotate without deactivating/deleting

[kadrach]

Would be nice to be able to rotate the "other" access key without disabling the current access key.

With longer-running batch processes that only read their credentials once, deactivating the "current" key after rotation may mean disabling a key that's still in use/expected to work.

This would mean a user always has two access keys active, and e.g. every 24h rotates "the older one".