security.yml encryption key rotation support

fixes CNVS-15647

test plan:
 * ensure that all of the following still work -
   * replying to an e-mail notification
   * displaying avatars
   * changing your avatar
   * uploading a file that's exempt from quota checks (i.e.
     submitting an assignment)
   * grade passback via LTI
   * add an object embed to a wiki page
 * rotate your encryption key -
   * in security.yml, move encryption_key to previous_encryption_keys,
     and put something else in encryption_key
 * repeat step 1, as much as possible using the original verifier
   from that step (i.e. reply to the original e-mail, refresh just
   the object embedded in the wiki page)

Change-Id: Id36bbb1711f8b6c6f960cc1e898b75e335bfac81
Reviewed-on: https://gerrit.instructure.com/41368
Reviewed-by: Jacob Fugal <jacob@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>