refactor(credential): make Rotator.Initialize take each credential explicitly

[aaron-zeisler]

Summary

Rotator.Initialize took a []SDKCredential and sorted it with a type switch. It expects one SDK key,
one mobile key, and one environment ID, but the signature never said so — pass two SDK keys and the last
one silently became the anchor. It now takes the three credentials as separate typed parameters, so the
compiler enforces what the code only assumed.

Follow-up to a review comment on #817, inline on internal/credential/rotator.go:86. No Jira ticket.

Background

The signature predates concurrent SDK keys. Once an environment could hold several keys, the slice's
ambiguity started to matter. The only production caller already passed exactly one of each, so relay
behavior does not change.

---

Note

Overview
Rotator.Initialize now takes one SDK key, one mobile key, and one environment ID as separate parameters instead of a []SDKCredential slice. The compiler enforces the one-of-each contract that the type switch previously only assumed (a second SDK key used to silently become the anchor).

Undefined credentials are still skipped. Extra accepted SDK keys continue to arrive only through Reconcile. Tests that needed a multi-key accepted set now build it that way.

^{Reviewed by Cursor Bugbot for commit 7fc38a6. Bugbot is set up for automated code reviews on this repo. Configure here.}