account_archive: re-work migrating process

When a device is expired, the migration will update the certificate
chain with the previous key. So, after a migration, the device's id
must be unchanged.
However, if a device is revoked, this should trigger a re-generation
of the device with a new PrivateKey (so generates a new device).
Add related unit tests.

GitLab: #684 (this is some preparative work)
Change-Id: I7ff0cff97b7285186539cfadc6e33b620ded5b27