Backport of oidc: check for nil signing key on rotation into release/1.9.x

[hc-github-team-secure-vault-core]

Backport

This PR is auto-generated from #13716 to be assessed for backporting due to the inclusion of the label backport/1.9.x.

The below text is copied from the body of the original PR.

---

Description

Check for a nil signing key before performing a rotation and before signing payloads. This is to prevent panics in the event that a nil signing key was written to storage.

If the current signing key is nil during rotation, we will skip setting the ExpireAt and allow the next signing key to be rotated into the current. If the signing key is nil during sign payload, we will return an error.

Background

A panic can occur for any key which was created while being on a version < v1.9.0 but was rotated while being on v1.9.0.

Repro steps:

• start vault with persistent storage
• create keys/roles with Vault < v1.9.0
• upgrade vault to v1.9.0
• manually rotate the key or wait for an auto rotation
• once key rotation triggers, a panic will occur
  • this was fixed in Identity: check NextSigningKey existence during key rotation #13298
• restarting vault v1.9.0 should result in panics on rotation
• upgrade vault to v1.9.1 or greater
• restart vault with same persistent storage backend
• once key rotation triggers, a panic will occur
  • this is being fix in the current PR