feat: support authenticated secret values

[alexey-igrychev]

Summary

Nelm v2 now uses common-go branch 1, adding authenticated AES-GCM secret encryption while retaining read support for existing AES-CBC secrets. It can read and write the format required by the werf v3 rollout.

Related: #677

What

Breaking

• BREAKING: secrets written by nelm v2 use AES-GCM formats that cannot be read by earlier nelm or werf releases. Upgrade every CI job and saved deploy-plan consumer before re-encrypting a repository.
• Existing AES-CBC encrypted values remain readable, but new writes use authenticated formats.

Secret values

• Whole-blob secrets use version 2 and YAML scalar secrets use version 3, preventing whole-blob values from being interpreted as scalar metadata.
• YAML scalar tags, block styles, and value comments survive a secret-values edit cycle. Existing values that lost their original type remain strings until re-entered.
• Whole-blob ciphertext can be used as a scalar in an additional secret-values file without frame corruption.

Why

The previous common-go AES-CBC format accepted tampered data and wrong keys without reliable detection, while secret YAML encryption discarded scalar metadata. Nelm needs the common-go v1 implementation so its v2 release participates in the coordinated authenticated-secret rollout with werf v3.

[alexey-igrychev]

Verification

• Linux (Go 1.25.5): task build and task test:unit passed against this commit.
• task format and task lint both fail with the same 12 pre-existing gosec G602 findings on pkg/action/release_history.go and pkg/action/release_list.go when run from origin/2; the bump adds no diff beyond go.mod/go.sum.

Review focus

• The common-go version range includes the versioned AES-GCM secret-format rollout and the removal of an unused deprecated missed-secret-key mode. Nelm v2 compiles and tests without that removed API.

Follow-up

• BLOCKER: Update github.com/werf/common-go in werf v3 to the same common-go/1 commit, then verify persisted deploy-plan and secret workflows.
• Document the minimum nelm v2 and werf v3 releases needed to read AES-GCM secret values before release.
• Close Secrets: preserve YAML scalar types and switch to authenticated encryption without breaking existing data #677 manually after both downstream bumps land.