Add rollback to LocalKeyRotation

The rollback would be as follow:

1. Test that the new keys are working: `sts.GetCallerIdentity`, and check that the user is the same (any other API would do as well)
2. If success then finish here
3. If failure then use the old credentials in memory and pass it to the file
4. Save the file
5. Reactivate the credentials (if needed)
6. Clean up: delete the newly created keys from IAM and the backup

Start by locating the LocalKeyRotation implementation and reading how it currently creates, stores, activates, and cleans up credentials. Use sts.GetCallerIdentity to verify the new credentials, then confirm that failure restores the old in-memory credentials and removes the new keys and backup.

Written by the indexing model from the issue text.