Release v19.4.0

Added

• [Encrypted] attribute (Cratis.Chronicle.ProtectedValues) for values that need encryption at rest without being personal data subject to GDPR right-to-erasure — an API key, a webhook signing secret, a partner credential (#4095)
• EncryptionScope.Subject (default), .Namespace, and .Global — the identity an [Encrypted] value's key is provisioned under. A subject-scoped key is always disjoint from any [PII] key for the same subject; a namespace-scoped key is shared by every value marked that way in one event store namespace; a global-scoped key is shared across the whole installation
• [PII] and [Encrypted] cannot both apply to the same value — rejected at schema-generation time, and flagged at compile time by a new analyzer (CHR0053), because the two would otherwise encrypt the value twice under two different keys and be unable to release it correctly
• [Encrypted] cannot be applied to an EventSourceId<T>, flagged at compile time by a new analyzer (CHR0052), mirroring the existing restriction on [PII]
• No API anywhere can delete an [Encrypted] value's key — PIIManager's erasure operations explicitly refuse an identifier belonging to an [Encrypted] value
• Cratis.Chronicle.Testing's EventScenario and related scenario helpers now protect [Encrypted] values the same way they already protect [PII] values
• Cratis.Chronicle.Confidentiality — a security metadata provider system (ICanProvideSecurityMetadataForType/ICanProvideSecurityMetadataForProperty, ISecurityMetadataResolver) parallel to the existing GDPR compliance one, for classifying a value as needing protection for security reasons rather than compliance reasons. [Encrypted] is its first consumer; [PII] continues to resolve only through the compliance provider system and never gains [Encrypted]'s wider scopes