[CHEF-5356-gcm] Encrypted data bags should use different HMAC key and include the IV in the HMAC

Alternative to the issue #1474, but using GCM instead of reinventing the wheel:

https://tickets.opscode.com/browse/CHEF-5356

* Requires OpenSSL `>= 1.0.1`.