Allow pause time after key sources have been updated

[eversC]

....in case users want to bail out of the key deletion.

[eversC]

Could also help applications that use the key to react to it being changed

[eversC]

This would need to be configurable, on the location level

[kkonstan-ovo]

A grace period during which both old and new keys are valid would also fix an issue with jobs running on CircleCI during key rotations.

With the current implementation any CircleCI jobs running during a key rotation will end up with invalid keys at some point during their execution as these are injected as environment variables when they're started.

Here's one example where terraform apply failed to upload state to S3 due to this:
https://ovotech.atlassian.net/browse/PSRE-436