Revoke a publishable key

Turns a key off. Needs settings: write, and is a write.

Every request made with it is refused from then on, so any page still carrying it stops being able to read this newsletter's data. Deploy the replacement before calling this.

The row survives and keeps its name, its prefix and the date it was turned off, because the question asked after an incident is "which key was that", and a row that vanished on revocation cannot answer it. Revoking an already revoked key succeeds and keeps the original date.

There is no un-revoke, for the reason there is none for an API key: a revocation that could be undone would let whoever found the key put it back.

Publishes no event.