Encrypt exernal access tokens

Note: this PR has gotten rather big, so I am breaking it up into smaller chunks. Keeping this around for reference.
#9421
#9433

This PR adds enterprise-only functionality to encrypt external database access tokens. This builds upon@kylecarbs' previous work in#7959.

• Adds a new tabledbcrypt_sentinel which is used as a litmus test for database encryption status.
• Adds packageenterprise/dbcrypt which handles encryption/decryption for the following fields:
  • dbcrypt_sentinel.value
  • user_links.oauth_access_token
  • user_links.oauth_refresh_token
  • git_auth_links.oauth_access_token
  • git_auth_links.oauth_refresh_token
• Adds support for specifyingEXTERNAL_TOKEN_ENCRYPTION_KEYS to enterprise server cmd.
  • When specified, thedatabase.Store will be wrapped bydbcrypt.Store.
  • At present, we only allow max. 2 keys; this is to force people to complete key rotation in a timely manner instead of continuously appending old keys.
• Adds adbcrypt-rotate enterprise subcommand (and associated test) to perform key rotation and re-encryption of affected rows.

Suggested attention:

• enterprise/dbcrypt - this is the most important piece
• enterprise/cli - specifically the rotation command
• enterprise/coderd - specifically the misc. plumbing

Checklist

• No experimental flags needed
• Testing:
  • Unit tests have been added
  • Manual testing has been performed using./scripts/dev-oidc.sh
• User-facing changes:
  • Add documentation under./docs (in progress)