Add a timelock and grace period to operator rotation

[Meshmulla]

Summary

Operator rotation (soroban/src/operator_rotation.rs) changes who controls sensitive operations. Instant rotations are risky — if a key is compromised, an attacker could rotate control away with no window to react. Adding a timelock and grace period gives observers time to detect and respond.

What we'd like

• A two-step rotation: propose_rotation then execute_rotation after a configurable delay
• A cancel path so a pending (malicious) rotation can be aborted by an authorized role before execution
• An event emitted at propose and execute so watchers can monitor pending rotations

Where to look

• soroban/src/operator_rotation.rs — the rotation logic
• soroban/src/acl.rs — roles allowed to propose/execute/cancel
• soroban/tests/operator_rotation.test.rs — extend these tests
• soroban/src/threshold_window.rs — an existing time-window pattern to mirror

Acceptance criteria

• Rotation requires propose → wait → execute, with a configurable delay
• A pending rotation can be cancelled by an authorized role
• Executing before the delay elapses reverts
• Events are emitted for propose/execute/cancel, with tests covering each path

Notes

Make the delay a configured parameter (with a sane default) rather than a hardcoded constant.