connect/ca: Add a method for manually forcing a root rotation

Currently there's no way to force the CA to rotate the active root outside of changing the CA config in a particular way to cause a rotation. We should add an api/CLI command explicitly for forcing this, to make a more clear workflow for this.

Start by locating the connect/ca implementation and its existing root-rotation path, then inspect the API and CLI entry points. Define the explicit force-rotation workflow and verify that both interfaces trigger the intended CA root rotation without requiring a configuration change.

Written by the indexing model from the issue text.