CHEF-3615 - Add encrypt-then-mac mode for encrypted data bag items

Adds a new format version for encrypted data bag items (version 2). This version uses encrypt-then-mac to authenticate the ciphertext. Configuration options are added so that users can opt-in to this mode and then opt out of accepting older format versions.