Key store key classes

Here's the functionality to provide classes of encryption for the key store keys.  The initial implementation effectively manages two stores:

- A store for keys that explicitly want their encryption to be based on a generated key—predominantly keys that need to be accessed independently of the timing of passcode validation, such as OAuth tokens.
- A (default) store for keys that want their encryption to be based on the user passcode.

Passcode-based keys will fall back to being stored in the generated key store, if a passcode either isn't configured, or becomes unconfigured (reset, turned off).  In the latter case, passcode-based keys will be migrated back to the generated key store.  Whenever a passcode is (re-)configured, those keys will be migrated back to the passcode store.

To do: there are a lot of unit test updates and additions that need to be made.  I've verified a lot of the corner and edge cases in my runtime debugging, but unit tests are a must for a facility with this kind of interoperating complexity.