load AWS key from encrypted databag

ec2_raid LWRP uses the AWS key specified by node attributes `node['aws']['databag_name']` and `node['aws']['databag_entry']`.

However some might want to encrypt that databag to protect the key.

This pull request adds 2 new attributes to do exactly that:

If `node['aws']['databag_name']` is an encrypted databag, set `node['aws']['databag_is_encrypted'] = true`.
An optional path to the secret key can be specified with `node['aws']['databag_secretpath']`.

Defaults are:
```ruby
default['aws']['databag_is_encrypted'] = false
default['aws']['databag_secretpath'] = nil
```