Fix/at rest encryption

[davidrotari19]

Notable changes

• see CHANGELOG.md

References

• solves Decouple at-rest and in-transit encryption #390

Checklist

• keep a changelog
• write tests
• create tickets for TODO: <> statements
• create or update documentation

[codecov]

Codecov Report

❌ Patch coverage is 52.95630% with 366 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cli/src/secrets/store/policy.rs	43.68%	58 Missing ⚠️
cli/src/secrets/secrets_status.rs	0.00%	49 Missing ⚠️
cli/src/secrets/secrets_rotate.rs	0.00%	46 Missing ⚠️
cli/src/secrets/secrets_disable.rs	0.00%	39 Missing ⚠️
cli/src/secrets/secrets_wipe.rs	0.00%	38 Missing ⚠️
cli/src/secrets/secrets_enable.rs	0.00%	31 Missing ⚠️
cli/src/secrets/store/master_key.rs	71.96%	30 Missing ⚠️
cli/src/secrets/mod.rs	0.00%	21 Missing ⚠️
cli/src/secrets/helpers.rs	0.00%	16 Missing ⚠️
sdk/src/secret_store.rs	92.95%	10 Missing ⚠️
... and 6 more

📢 Thoughts on this report? Let us know!

[kouks]

LGTM - just a note that this has workbench implications, worth noting it down to the ticket that nexus crypto init-key is no longer a thing,