connect: support migrating Key type when using Vault as a CA Provider

## History

In #6638 we added support for RSA keys for connect CAs however we discovered a limitation in Vault's PKI that prevented CA providers with one key type signing certificates with a different key type. See https://github.com/hashicorp/consul/pull/6638#issuecomment-544919109.

For that reason [we document](https://www.consul.io/docs/connect/ca/vault#privatekeytype):

> Some CA providers (currently Vault) will not allow cross-signing a new CA certificate with a different key type. This means that if you migrate from an RSA-keyed Vault CA to an EC-keyed CA from any provider, you may have to proceed without cross-signing which risks temporary connection issues for workloads during the new certificate rollout. We highly recommend testing this outside of production to understand the impact, and suggest sticking to same key type where possible.

**This is not a major limitation in practice**, few people need to migrate away from Vault or change their key type within Vault so the impact is likely low.

However as of a few days ago Vault's main branch now does support this: https://github.com/hashicorp/vault/commit/ac56e5571dfe0c4166bf72def6045632da2d776b this will presumably be released in Vault 1.9.0.

After that, Vault 1.9.0 and higher could in theory support moving from one Vault CA to another CA with a different key type.

## Action Needed

I'm not sure if we'd actually need to change any code here but we may want to:
* test it (and likely add any test cases that were omitted from #6638 when we realised it wasn't supported)
* update the documentation above

Given the relatively low impact of the current limitation, any feedback in forms of +1 reactions or comments with significant detail about how this would benefit you would help us understand if this work is worth prioritizing. Also testing once Vault 1.9.x is out and PRs are welcome!