Release v19.99.1

Changed

• Azure Key Vault used as the encryption key store must allow purging deleted secrets: grant the purge permission and do not enable purge protection on that vault, otherwise erasing a subject fails. (#3674)

Fixed

• Provisioning an encryption key is now atomic on every key store. Two kernels that provision the same subject's key at once always end up using the same key: SQL and MongoDB no longer return a key that was never stored, HashiCorp Vault writes with check-and-set, and Azure Key Vault elects one key among concurrent writers. If the winning key cannot be read back, provisioning fails instead of encrypting with a key that would be lost. (#3745)
• Erasing a subject on Azure Key Vault now purges every revision of the encryption key instead of only soft-deleting it, so the key cannot be recovered from the vault's deleted secrets. If the vault refuses the purge (purge protection, or a missing purge permission), erasure fails instead of reporting success. (#3674)