feat: wrap the store's data key in credential slots

[fbwoolf]

Closes #56.

This conflicts with #58

Follow-up to #49, where @Robert-MacWha pointed out that holding the password directly blocks hardware unlock in the future. The fix is easier now than later.

Records no longer hang off the password. The store generates a random data key and holds it in the header wrapped by a list of credential slots, each able to recover it alone. argon2id-password is the only kind implemented, so nothing but a password unlocks anything today. A slot's parameters are opaque under its kind tag, so a build that does not recognize a slot still unlocks through one it does, which makes a hardware slot additive rather than a format break.

create, unlock and open_or_create are unchanged. change_password is new and rewraps one slot in a single header write without touching a record. slot_kinds lists what is enrolled. KeySource, DataKey and StoredSlot are pub(crate), since a slot implementation handles the data key in the clear; can be changed to be public now.

The encryption integration tests are back, at core/tests/database/. #48 deleted them along with the wallet crate and did not replace them, so master currently has no coverage of scope isolation, key blinding, store permissions, or the header-parameter validation added in #51. This branch had to touch that file anyway, so restoring it here was cheaper than losing the tests and re-adding them later.

[kassandraoftroy]

SGTM, i like it. Let's see what @Robert-MacWha thinks. I can rebase #58 after we merge this.

[kassandraoftroy]

LGTM