Cleanup retired KEKs after callers re-encrypt data with current KEK versions.

Destructive cleanup defaults to dry-run. Pass dry_run: false to unlink current KEKs from retired versions and delete retired rows.