Release v15.38.2

Fixed

• Read models keyed by a property other than their event source id (for example [FromEvent<T>(key: nameof(...))], or a re-keyed reducer) now decrypt their [PII] properties on read. Previously the value was encrypted under the source event's subject while the document was stored under a different key, so queries and command-side reads returned it as ciphertext. The read-model document now encrypts and releases its PII under its own resolved key, so it stays decryptable for the document's whole lifetime.