feat: reland vault w/o pgsodium

[soedirgo]

Reland #1431; the migration has been merged in #1442

Tested flows on local infra:

1. pause & restore w/o vault
   • create a new project
   • drop extension supabase_vault cascade;
   • pause project
   • restore project
   • select * from vault.decrypted_secrets
2. pause & restore w/ existing secrets
   • create a new project
   • create a new secret in Settings > Vault
   • pause project
   • restore project
   • select * from vault.decrypted_secrets
3. pause & restore w/ existing secrets w/o pgsodium
   • follow steps in 2
   • drop extension pgsodium
   • pause project
   • restore project
   • select * from vault.decrypted_secrets
4. pg_upgrade
   • create a new project on an earlier AMI version (e.g. 15.8.1.044)
   • create a new secret in Settings > Vault
   • upgrade project in Settings > Infrastructure
   • select * from vault.decrypted_secrets

[barrownicholas]

Just wanted to check the status of this; we need vault 0.3.1 since it fixes a bug where secrets cannot be empty. Any updates?

[soedirgo]

Hey @barrownicholas, this should be available on new & upgraded projects in a few weeks

[darora]

Is this supposed to be 0.3.0?? The PR is bumping it from 0.2.9 to 0.3.1, where does 0.3.0 come in from?

Also it feels like this patch would need to be executed even if in the future we were on e.g. 0.3.2, and we're likely going to forget to do so?

[soedirgo]

Yep, the query runs for all versions >= 0.3.0. Vault >=0.3.1 would still have 0.3.0 in pg_available_extension_versions

[samrose]

@doublethink @staaldraad can you please have a look at this to make sure you don't see any known security issues with these changes, and thanks!