[CHEF-3858] ensure invalid key always fails to decrypt

In Ci, we occasionally see test failures when decryption with an
incorrect key does not raise an error, but instead returns garbage.

This fixes that issue by adding an HMAC-SHA2-256 of the encrypted data
to the version 1 format. For backwards compatibility, decryption will
continue if the hmac is missing; therefore, this does not increase the
security of encrypted data bag items.
[CHEF-3615] version 2 encryptor/decryptor for EDBIs

Authenticated encryption data bag items will be version 2 of the
encrypted data bag item format instead of tacked on to the version 1
format.

Authenticated encryption via OpenSSL cipher was considered, but older
openssl versions do not have, e.g., aes-256-gcm, so we are implementing
encrypt-then-mac with hmac-sha256 on top of existing aes cipher.

Code passes tests but is not yet exposed in configuration. TODO:
* Allow user to set desired version for encrypt.
* Allow user to set minimum required version for decrypt. Without this
  change, a MITM could simply change the format version to 1 to bypass
  the hmac.
[CHEF-3615] Make encrypted data bag format configurable

* Add an option to configure the version used when encrypting data bag
  items. This allows users to opt-in to newer encrypted data bag formats
  while the default remains compatible with earlier chef versions.
* Add an option to set a minimum valid encrypted data bag item format.
  This is useful on the client so that, for example, a MITM attacker
  cannot downgrade a v2 EDBI to v1.
Merge branch 'CHEF-3615'