fix plaintext information leak

This changes the salt for a file to be the HMAC of its contents keyed
with filename:password instead of the plain hash of its contents. Pre-
change an attacker may make guesses at the files contents and confirm
them with high probability by checking to see whether the salt matches.
This would be a concern in the case of a config file where almost
everything is known, for example everything excpet for a password is
known. This change also prevents an attacker from seeing that the
contents of two encrypted files are the same.

There may still be other security issues.

This commit doesn't change the version number or try to maintain
compatibility with older repos.