rotateDeviceAuthenticationKeyIfNeeded

Rotates the device authentication key if policy says it is due, with the routine rotation of rotateDeviceAuthenticationKey (docs/device-authentication-rotation.md). Only runs when the application calls it: nothing in the library calls it implicitly.

• A pending device recovery or last-device recovery: returns DeviceAuthenticationRotationResult.RecoveryInProgress, starts nothing.

• A pending routine rotation: completes it with its existing key (including the lost-response resolution of completeDeviceAuthenticationRotation) and returns DeviceAuthenticationRotationResult.ResumedPendingRotation; never a second pending key.

• Otherwise reads the status from the server: not due returns DeviceAuthenticationRotationResult.NotNeeded, due rotates and returns DeviceAuthenticationRotationResult.Rotated.

Concurrent calls on one instance run one after the other: the second sees the new key's age and returns NotNeeded. Throws what completeDeviceAuthenticationRotation throws.