prop224: Make intro point per-service and not per-descriptor
With the service branch in #20657 (moved), the current code design has intro points (IPs) per-descriptor meaning intro point objects are indexed inside a descriptor object.
We want to change that to a per-service design for which there is a set of intro points picked by the service which are then assigned to descriptor(s).
The reason to do such a thing is so we expose less IPs overtime thus minimizing the service exposure. Currently, because IPS are per-descriptor, once the descriptor rotates we also rotate IPs which bounds IPs' lifetime to the descriptor lifetime but this is not always true (and should not).
With a per-service design, IPs can live on between descriptors because they rotate at a different rate than the IPs and thus honoring its lifetime.