Key derivation to replace individual keys in encryptor

[gak]

• Follow up from feat: Encrypt sensitive internal table columns #2248
• Work out if the migration should be online or offline ✅ .
• Work out if all the key deriving works with tink. ✅
  • deriver, err := keyderivation.New(handle), derivedHandle, err := deriver.DeriveKeyset([]byte("salt"))
• KMS + streaming (not streaming)
• One DEK that derives keyTwo DEKs for async and logs, later artefact integrity which will be asymmetric
• Config/env for kms kek url
• Still allow clear text keys for testing (via fake-aws://)
• Migration
  • Table for encrypted key with only 1 row containing encrypted dek and encrypted dk. Later will have more rows for key rotation.
  • Move columns to bytea instead of jsonb