Allow resigning of events with a new signing key (#19668)

This adds a way to re-sign all locally-created events with a new signing
key, which is useful when rotating server signing keys.

This doesn't trigger automatically, instead needs to be triggered when
needed via the admin API.

c.f.
https://github.com/matrix-org/internal-config/issues/1670#issuecomment-4206020126
for internal discussion.

---------

Co-authored-by: Kegan Dougall <kegan@element.io>
Co-authored-by: Erik Johnston <erikj@element.io>

docs/usage/administration/admin_api/background_updates.md

@@ -107,3 +107,6 @@ The following JSON body parameters are available:
 - `job_name` - A string which job to run. Valid values are:
   - `populate_stats_process_rooms` - Recalculate the stats for all rooms.
   - `regenerate_directory` - Recalculate the [user directory](../../../user_directory.md) if it is stale or out of sync.
+  - `event_resign` - Re-sign all locally-sent events with the current signing key. This is useful after rotating the server's signing key to ensure all historical events are signed with the new key. Optional additional parameters:
+    - `old_key` - Only re-sign events whose signature verifies against this key. Format: `"ed25519:key_id base64_public_key"` (e.g. `"ed25519:my_old_key XGX0JRS2Af3be3knz2fBiRbApjm2Dh61gXDJA8kcJNI"`).
+    - `before_ts` - Only re-sign events with a `received_ts` less than this value (milliseconds since the epoch).