This task is to explore if we can and want to allow toolforge users to be able to self-rotate their credentials.

Current credentials:

• k8s/api certs <- users can self-rotate (generate new certs), but old certs can't be revoked, see T365681: toolforge: kubernetes can't revoke certificates
• replica database credentials <- this and the next need admin action
• toolsdb credentials

This might influence the following:

• T358496: [toolforge,storage] Provide per-tool access to cloud-vps object storage
• T363983: [toolforge] Investigate authentication
• T365681: toolforge: kubernetes can't revoke certificates

This was created following up on T365644: Remote Code Execution on svgtranslate