Add mechanism to rotate credentials for pgstac_user

There could be scenarios where it would be useful to be able to rotate the credentials (i.e. password) for the pgstac_user on the pgstac database. This would involve:

1. Generating a new password, updating the secret (pgbouncer and otherwise)
2. Connecting to the database and updating the password for pgstac_user
3. Updating the credentials on the pgbouncer instance if it exists

Start by locating the code that creates or updates the pgstac_user secret, connects to the pgstac database, and configures the pgbouncer instance if present. Trace how credentials currently reach each component, then define completion as generating a new password, updating all relevant secrets, changing the database password, and synchronizing pgbouncer credentials.

Written by the indexing model from the issue text.