Support LTPA rotation without requiring planned outage

Idea: make Liberty feature parity with traditional WAS to allow LtpaToken key rotation without having to restart the Liberty profile.

LtpaToken SSO key rotation in Liberty currently requires a planned outage, unlike traditional WAS which can rotate the key on the fly. The traditional WAS administrative console setting controls for automatic key re-generation filled a function in high-security sites to make mounting a session attack prohibitively costly. The feature created a new key without requiring any administrator intervention, nor restarting of WAS profiles.

There is no way to re-generate the LTPA keys on-demand without a Liberty profile restart so it can be automated out-of-band of Liberty; and even that procedure is not shown in the product documentation as far as I can tell.

Thus, using third-party information sources and not the product documentation, as best as I can tell the only way to implement a high-security configuration with Liberty profiles without interrupting the application is only under applications like IBM Workload Scheduler that support session persistence. We would have to architect a load-balancer-fronted multiple-master configuration that fails over to a standby, transparently carrying sessions with it, drop the target master from the load balancer rotation, shut down the profile, force the password change of the LTPA key, start up the profile which generates a new LTPA key, and then return the node to the load balancer rotation. That's a big increase in operational complexity to rotate the LTPA key with the same no-restart functionality as traditional WAS.