[FEATURE REQUEST] salt-rekey functionality for Salt-managed minion/master key rotation

Is your feature request related to a problem? Please describe.

There are several reasons to rotate keys. One example is exposure or a compromised key. An easy way to rotate a key is to remove the existing keys and let the salt-master or salt-minion process generate new keys on restart.

Documentation was added for users with #59271 to resolve #57725, and this feature request came out of conversations around the creation of the docs.

The Salt key rotation problem is a multi-step process that has to be manually done, or scripted by the users themselves, or completed via the use of tools like salt-rekey that aren't supported/managed by Salt Project itself.

NOTE: salt-rekey, linked above, includes the following disclaimer: This script is provided without any fitness or warranty. It may cause minions to be disconnected from the Salt master and fail to reconnect, forcing manual intervention.

Describe the solution you'd like

Salt itself should have the ability to initiate a process to rotate keys on selected targets, allowing for a supported feature of Salt to be readily available for users in their environments.

This could be an extension of saltutil.regen_keys, or act as a different saltutil.* call.

Describe alternatives you've considered

Another alternative is to take salt-rekey and have it managed under the SaltStack org, to be managed as a tool that is separate from the Salt repo itself. That, or a new salt extension managed under that SaltStack org, if not

Additional context

The following description is copied from salt-rekey, and is why this feature request is being made:

This is a script designed to quickly re-key Salt minions. It was written originally as a part of the mitigation efforts for CVE-2020-11651 and CVE-2020-11652 but it can be used in any scenario in which all minions connected to a Salt master should be forced to re-generate their keys and re-connect.

For background information on Salt's security model and the role of keys, please see this document:

• SaltStack Trust: An overview of the SaltStack platform security model

The Why: One may wish to rekey minions in any event where the key(s) of the minion or of the master can no longer be trusted, as in the case of a security breach.