fix non-fatal assertion when rotate_onion_key fails

fix #40554 (closed)

The very first iteration does not raise an error as desc_dirty_reason is initialized to "Tor just started". After that, router_rebuild_descriptor clears desc_dirty_reason when it's called for the first time.

On following iterations, that value should have been set again in rotate_onion_key (call to mark_my_descriptor_dirty), but as rotate_onion_key failed, it never went down to marking the descriptor dirty. router_rebuild_descriptor is then called unconditionally, and complain about the unset value.

The change I suggest is to acknowledge rotate_onion_key can fail, and not inform cpu worker and rebuild a descriptor when rotating the onion key failed