[Pm 3797 Part 2] Add emergency access rotations (#3434)

## Type of change

<!-- (mark with an `X`) -->

```
- [ ] Bug fix
- [ ] New feature development
- [x] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other
```

## Objective
<!--Describe what the purpose of this PR is. For example: what bug you're fixing or what new feature you're adding-->
See #3425 for part 1 and background.

This PR adds emergency access to the rotation. All new code is hidden behind a feature flag.

The Accounts controller has also been moved to Auth ownership.

## Code changes
<!--Explain the changes you've made to each file or major component. This should help the reviewer understand your changes-->
<!--Also refer to any related changes or PRs in other repositories-->

* **file.ext:** Description of what was changed and why
* **AccountsController.cs:** Moved to Auth ownership. Emergency access validation was added (as well as initializing empty lists to avoid errors).
* **EmergencyAccessRotationValidator.cs:** Performs validation on the provided list of new emergency access keys.
* **EmergencyAccessRepository.cs:** Adds a method to rotate encryption keys. This is added to a list in the `RotateUserKeyCommand` that the `UserRepository` calls so it doesn't have to know about all the domains.

## Before you submit

- Please check for formatting errors (`dotnet format --verify-no-changes`) (required)
- If making database changes - make sure you also update Entity Framework queries and/or migrations
- Please add **unit tests** where it makes sense to do so (encouraged but not required)
- If this change requires a **documentation update** - notify the documentation team
- If this change has particular **deployment requirements** - notify the DevOps team

src/Api/Auth/Validators/EmergencyAccessRotationValidator.cs

@@ -0,0 +1,58 @@
+using Bit.Api.Auth.Models.Request;
+using Bit.Core.Auth.Entities;
+using Bit.Core.Entities;
+using Bit.Core.Exceptions;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+
+namespace Bit.Api.Auth.Validators;
+
+public class EmergencyAccessRotationValidator : IRotationValidator<IEnumerable<EmergencyAccessWithIdRequestModel>,
+    IEnumerable<EmergencyAccess>>
+{
+    private readonly IEmergencyAccessRepository _emergencyAccessRepository;
+    private readonly IUserService _userService;
+
+    public EmergencyAccessRotationValidator(IEmergencyAccessRepository emergencyAccessRepository,
+        IUserService userService)
+    {
+        _emergencyAccessRepository = emergencyAccessRepository;
+        _userService = userService;
+    }
+
+    public async Task<IEnumerable<EmergencyAccess>> ValidateAsync(User user,
+        IEnumerable<EmergencyAccessWithIdRequestModel> emergencyAccessKeys)
+    {
+        var result = new List<EmergencyAccess>();
+        if (emergencyAccessKeys == null || !emergencyAccessKeys.Any())
+        {
+            return result;
+        }
+
+        var existing = await _emergencyAccessRepository.GetManyDetailsByGrantorIdAsync(user.Id);
+        if (existing == null || !existing.Any())
+        {
+            return result;
+        }
+        // Exclude any emergency access that has not been confirmed yet.
+        existing = existing.Where(ea => ea.KeyEncrypted != null).ToList();
+
+        foreach (var ea in existing)
+        {
+            var emergencyAccess = emergencyAccessKeys.FirstOrDefault(c => c.Id == ea.Id);
+            if (emergencyAccess == null)
+            {
+                throw new BadRequestException("All existing emergency access keys must be included in the rotation.");
+            }
+
+            if (emergencyAccess.KeyEncrypted == null)
+            {
+                throw new BadRequestException("Emergency access keys cannot be set to null during rotation.");
+            }
+
+            result.Add(emergencyAccess.ToEmergencyAccess(ea));
+        }
+
+        return result;
+    }
+}