Add encrypt/decrypt commands (use -k to specify key)

The key format can be plaintext (symmetric key, not recommended but quick
and dirty), or PEM encoded key data, or (for encryption only) a base64
encoded public key (like in ~/.ssh/id_rsa or like you get from the
Spring Cloud configserver /key endpoint).