test(ssh): cover key rotation with Molecule

Replace a private key while retaining its public key file to detect stale derived keys.
Verify the replacement public key, ownership and file permissions.

Co-authored-by: Copilot <copilot@github.com>

molecule/default/create.yml

@@ -37,10 +37,22 @@
     - "{{ _authorized_key }}"
 
   # The key pair is generated instead of committed, private key material does not belong into a repository.
-  - name: Generate the ssh key pair the role is fed with
+  - name: Generate the SSH key pairs for initial configuration and rotation
     ansible.builtin.command:
-      cmd: "ssh-keygen -t ed25519 -N '' -C molecule -f {{ _private_key }}"
-      creates: "{{ _private_key }}"
+      argv:
+      - ssh-keygen
+      - -t
+      - ed25519
+      - -N
+      - ''
+      - -C
+      - molecule
+      - -f
+      - "{{ item }}"
+      creates: "{{ item }}"
+    loop:
+    - "{{ _private_key }}"
+    - "{{ _private_key }}.replacement"
 
   - name: Offer the public key as authorized key fixture
     ansible.builtin.copy: