Explore solutions to preserving usage of document registrations when HMACs rotate

Currently when a tokenizer rotates (hmac rotation) and a new one becomes current, all existing document registrations will no longer be reused when generating new tokens. In other words, a "new identity" will be created for every document registration that occurs after the rotation. There are a number of ways to address this for workflows where it matters. At least two ways include:

1. Pre-duplicating all document registrations using the new tokenizer prior to making it current.
2. Hashing for every possibly "still in use" tokenizer -- instead of just the current one -- when looking up existing records. When an existing record is found, it could be updated to use the next tokenizer. Eventually, the "previous" tokenizer would drop off. See bedrock-resource-restriction for some patterns to consider.

No files or tests are named. Start by tracing tokenizer rotation and document-registration lookup in bedrock-tokenization, then review the linked bedrock-resource-restriction patterns. Done requires selecting and implementing a design that preserves registration reuse across rotation, with validation for the affected workflows.