engineccl: use incremental, records-based format for data key rotations

[jbowens]

The CockroachDB encryption-at-rest implementation uses a file called the 'data keys registry' for storing the encryption keys used to encrypt a store's files. When the active data key is rotated, a new file is added to a protocol buffer and the active file is replaced with a new one containing the updated protocol buffer. As a store accumulates data keys, the cost of rotation grows. Rotation requires a O(# data keys) write to disk. Currently, the encryption-at-rest implementation never removes data keys from the data keys registry, which exacerbates the impact of this rewrite (see #70138).

We should modify the data keys registry to use Pebble's record package to write incremental updates to the data keys registry during rotations. Since 21.2 this is the approach that the file registry uses to record which files are encrypted with which data keys.

Jira issue: CRDB-9958

Epic CRDB-16419

[jbowens]

NB: This is a similar issue as #55967, but not as impactful since data key registries are significantly less frequent than file creations, removals or renames.

[github-actions]

We have marked this issue as stale because it has been inactive for
18 months. If this issue is still relevant, removing the stale label
or adding a comment will keep it active. Otherwise, we'll close it in
10 days to keep the issue queue tidy. Thank you for your contribution
to CockroachDB!