[CHEF-5356-gcm] Encrypted data bags should use different HMAC key and include the IV in the HMAC

Alternative to the issue #1474, but using GCM instead of reinventing the wheel:

https://tickets.opscode.com/browse/CHEF-5356

* Requires OpenSSL `>= 1.0.1`.
well older ruby libs don't seem to support auth_data, and i wouldn't really call that an 'attack', i'd call it an administrative 'mistake' and that's really why data bags should be versioned explicitly or implicitly and should be Q/A tested which solves the problem for non-encrypted data bags as well.  don't see this as being worth it.