Client side encryption

Here's some code to encrypt client-side the snapshots stored in S3 .

It uses the [envelope encryption](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingClientSideEncryption.html) of the AWS ADK for Java (AES 256 in [CBC mode](http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher-block_chaining_.28CBC.29)). You case use keys of 128, 192 or 256 bits but you ***have to*** install the [JCE](http://en.wikipedia.org/wiki/Java_Cryptography_Extension) because the envelope encryption ***will*** use 256bits keys.

The key can be specified when configuring the repository. 

Example with a 128 bits AES symmetric key:
```sh
$ curl -XPUT 'http://localhost:9200/_snapshot/my_s3_repository' -d '{
    "type": "s3",
    "settings": {
        "bucket": "my_bucket_name",
        "region": "us-west",
        "client_side_encryption_key": {
            "symmetric": "Hk/RABbqRnhgSAMXiVUV0w=="
        }
    }
}'
```

Example with a 512 bits RSA key pair:
```sh
$ curl -XPUT 'http://localhost:9200/_snapshot/my_s3_repository' -d '{
    "type": "s3",
    "settings": {
        "bucket": "my_bucket_name",
        "region": "us-west",
        "client_side_encryption_key": {
            "public": "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALb4IRgaDtmwsz+kC/bkKLno5bRWMDbRDztcM/N/VJIg+HQKA8ees6uznEOGe6cOZp+QHYrpTIXs36QB9vfsVdUCAwEAAQ==",
            "private": "MIIBUwIBADANBgkqhkiG9w0BAQEFAASCAT0wggE5AgEAAkEAtvghGBoO2bCzP6QL9uQouejltFYwNtEPO1wz839UkiD4dAoDx56zq7OcQ4Z7pw5mn5AdiulMhezfpAH29+xV1QIDAQABAkBEy/OVnmarD7e2XDZrdMqjbKDCOA4U7nKtvTODgQMJll0b7wA52bY/kG8gA8Q2aqiKVHDRl/EQ33bELr2A56NBAiEA4+7qC/TMw2V2q+FuW5Az8mzfCH6mNmyMLc/XwuZ2/V0CIQDNf9NRbZ0EZQCiq6iBjgYzkdJlv1tDt9erqVj0w0K62QIgZDE5IFhTSfDn4VYOtKEGtKG2yH0jgvjkBZ8/MKUt2OECIFSzDuJND560EqL5paZgZ2XyAIo3aOJsb9QtJKEdqe9hAiBgithEZGGQNV/pXweOtku/CezLvY2FJaSPShfeQfXjcg==",
        }
    }
}'
```
I added a test case to make sure that the files are encrypted and I modified `testSimpleWorkflow()` to make sure that by default the files are not encrypted.

I haven't updated the documentation yet, I would like to get some reviews first.

- [x] Encryption
- [x] Decryption
- [x] Test case
- [x] Documentation

---
- [x] [Sign the CLA](http://www.elasticsearch.org/contributor-agreement/)

Wondering why we would need that. Does it mean that we could have multiple clients for the same "<accesskey,endpoint>"? One with a given encryption, another one with another encryption and another one without encryption?

I might be wrong but I think that keeping `(acceskey, endpoint) -> client` could be enough.

WDYT?