Replace AES-CBC with Crypto::SecretBox

This replaces the previous use of AES-CBC mode, which is known to be
fraught with problems when used incorrectly, with Crypto::SecretBox from
NaCl.

This also removes OpenSSL as a dependency. Woohoo!

Crypto::SecretBox, in addition to using the excellent XSalsa20 stream
cipher, also adds an additional line of defense against various types of
attacks: the Poly1305 MAC. Some might consider this redundant as
Keyspace already verifies the authenticity of ciphertexts with Ed25519,
however by using Crypto::SecretBox an attacker would have to forge not
only an Ed25519 signature, but also a Poly1305 MAC. Some might call that
redundant, I call it "Defense in Depth" ;)

It's a debatable issue. See Zooko's thoughts on whether an authenticated
encryption mode is needed here:

https://plus.google.com/108313527900507320366/posts/cMng6kChAAW

I asked djb about whether SecretBox was needed here or if it was okay to
use the raw XSalsa20 function. He responded:

    I don't think that this type of application suffers from having 16 extra
    bytes for a MAC. Probably leaving out the MAC is safe, but it's
    important to have someone reviewing the details.

Seems good to me. I'd like for Keyspace to be as boring as possible, and
I feel using Crypto::SecretBox improves the boring-ness factor.