feat: CRP-2911 Modify AES-GCM encryption to be more robust

[randombit]

Changes include

• DerivedKeyMaterial is, instead of being just the raw VetKey treated as an HKDF key, is first hashed. This prevents working backwards from a DerivedKeyMaterial to the original VetKey.
• The user specified domain separator is prefixed with our own specific domain separator
• The GCM ciphertexts now include an 8 byte header with a version field to allow easier transitions in the future
• Key derivation takes into account both the user specified domain separator and the ciphertext version
• Added support for associated data

These changes are not backwards compatible. Backwards compatability could be added in the future if required (eg if the header is unknown, attempt to decrypt using the old scheme - if it works, return the recovered plaintext). The hope is that this is not required.

[fspreiss]

Thanks, @randombit!

[randombit]

This is now ready for a new review

[fspreiss]

Thanks for addressing the comments, @randombit, and for adding the respective changes also in Typescript.

[fspreiss]

Thanks for addressing all the comments, @randombit!