Fix s3 envelope encryption

[endgame]

This builds on @andreyk0 's previous branch, but clears up all the merge conflicts, modernises the conduit usage and avoids reimplementing some functions already provided by conduit.

Tested using https://github.com/gilt/kms-s3/ which also needed updating but that's not our responsibility.

Tested: smaller files (<8192b) and larger files containing random data, including lengths not divisible by powers of 2 (so padding at the end should be right). Their sha256sum matched after roundtrip put/get. Also fetched the stored object directly off S3 and verified that its has was different, so it's actually doing something.

Fixes #393
Closes #405

[brendanhay]

Thanks a bunch for doing this! Just for posterity, this package won't be released to hackage as part of 2.0/RC, I'm particularly hesitant to encourage the use of cryptography in Haskell for the average user. The library should probably come with a big(er) fat(er) disclaimer in the readme + description.

[endgame]

Yep, I'm cool with your policy of keeping amazonka-s3-encryption off Hackage until it's either vetted or gets louder "use at own risk" warnings. Should I drop the changelog entry from the PR?

[brendanhay]

Might as well keep it around - it's a weird changelog in the sense it represents the entire monorepo, not only amazonka - but is displayed on hackage as part of the latter.