Use a separate symmetric key per packfile (REPO FORMAT CHANGE)

A separate key per pack is simpler and costs us very little; with
repack changes later it will be possible to change keys regularly.