engineccl: Reload encryption-at-rest keys on SIGHUP

**Is your feature request related to a problem? Please describe.**

Key rotation for encryption-at-rest currently requires a node restart to change the `--enterprise-encryption` flag. This should be reloaded on SIGHUP just like TLS certificates and keys

**Describe the solution you'd like**

PebbleKeyManager should use sysutil.RefreshSignaledChan to listen for SIGHUP and reload the keys on demand.

**Describe alternatives you've considered**

The way that "plain" is used as a magic filename in the `--enterprise-encryption` flag means that we can only use SIGHUP to rotate between different keys, not to convert between plaintext and encryption (so this operation will continue to require a restart). This seems fine, since switching between plaintext and encryption is at most a one-time operation per cluster (and most users of encryption will want it enabled from the start)

**Additional context**

The rotation process implied by our current interface is
1. Verify that the key named by `old-key` is not currently in use
2. Generate a new key with an unused name (this implies persisting a sequence counter somewhere, or inspecting to see what key names are currently in use)
3. Restart the server with the old-key and key fields of `--enterprise-encryption` updated
4. (Optionally?) delete the N-2 key, leaving only current and N-1.

The new interface implies a rotation process of
1. Verify that the key named by `old-key` is not currently in use
2. Copy `key` to `old-key` (overwriting the existing file)
3. Generate a new key in `key`
4. Send SIGHUP to the server to load the new keys

Jira issue: CRDB-36537