Cookies digest config option (pt. 2)

Another take on https://github.com/rails/rails/pull/16434

Now with comma, support for encrypted jar plus better test for verifier and new ugly test encryptor.

/cc @tamird @chancancode
Do you need to default it here? Message Verified already defaults to SHA1