rgw/kms/vault - encryption context - first part

rgw/kms/vault - encryption context - first part

This includes the logic to process the user provided
encryption context, turn it into "canonical json", and
to add in a default arn if it's not present.

Also present here is the start of logic to distinguish
between "prepare_encrypt" and "prepare_decrypt" at a lower
level; as "make_key" and "reconstitute_key" these will be
the functions that separately create a new datakey using
the vault transit operation, and to retrieve a previously
stored datakey.

Fixes: http://tracker.ceph.com/issues/48746
Signed-off-by: Marcus Watts <mwatts@redhat.com>