Replace --expiring option in secret rotation tool with --force

Currently, the tool defaults to rotating all secrets, but can be set to rotate only expiring secrets using the option `--expiring`

This should be replace with a default to rotating expiring, optionally rotating secrets that aren't expiring using the `--force` option

Start at the secret rotation tool's CLI entry point and trace the existing --expiring option handling. Update the default behavior and option name as described, then verify the command help and any available CLI tests cover rotating expiring secrets by default and all secrets with --force.

Written by the indexing model from the issue text.