refactor(repository): Move encryption into a common package in preparation to handle secrets

[PhracturedBlue]

As requested in #3345 this is just a code reorg with no functionality change to prepare for reusing the encryption functions for the secret manager.

[codecov]

Codecov Report

Patch coverage: 66.66% and project coverage change: -0.05% ⚠️

Comparison is base (814738c) 75.88% compared to head (50ccabc) 75.83%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3351      +/-   ##
==========================================
- Coverage   75.88%   75.83%   -0.05%     
==========================================
  Files         462      463       +1     
  Lines       37082    37100      +18     
==========================================
- Hits        28138    28136       -2     
- Misses       7020     7034      +14     
- Partials     1924     1930       +6     

Files Changed	Coverage Δ
internal/crypto/aesgcm.go	62.50% <62.50%> (ø)
internal/crypto/key_derivation_testing.go	58.33% <66.66%> (ø)
repo/format/format_blob.go	75.40% <66.66%> (+3.04%)	⬆️
internal/crypto/key_derivation.go	71.42% <100.00%> (ø)
repo/open.go	77.70% <100.00%> (-0.99%)	⬇️
repo/repository.go	79.34% <100.00%> (ø)

... and 4 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.