[CHEF-5356-gcm] Encrypted data bags should use different HMAC key and include the IV in the HMAC

Alternative to the issue #1474, but using GCM instead of reinventing the wheel:

https://tickets.opscode.com/browse/CHEF-5356

* Requires OpenSSL `>= 1.0.1`.
Here it might be interesting to add some data to authenticate, such as: `{ name: DATABAG_NAME, item: ITEM_NAME, key: ITEM_KEY }`. This would prevent attacks similar to the following:

```console
$ knife data bag show user_credentials guests -F json > guests.json
$ sed s/guests/admins/ guests.json > admins.json # change the id
$ knife data bag from file user_credentials admins.json
```
In this hypothetical case, without the data bag key, you will be able to overwrite the admin users.

But this will require some changes in the `EncryptedDataBagItem#encrypt_data_bag_item` and related methods. What do you think?