Lox check_lox_pubkeys_update only run for active credentials

Currently we only run check_lox_pubkeys_update using the #activeLoxId credentials. But in theory we could have multiple credentials that need updating. E.g.

1. A user already has lox credentials.
2. They redeem a new invite. The new invite credentials are stored under a new loxId but are not active yet.
3. A background task is triggered for #activeLoxId and the pubkeys are different.

In this case we would probably want to update both the new loxId credentials as well as #activeLoxId.

However, it should be noted that currently we store credentials indefinitely, even after they are replaced.

/cc @pierov @cohosh @onyinyang