Issue #3594165: pdv_client: encrypt stored vault handles at rest with an optional key

Frank Mablyrequested to merge
issue/pdv-3594111:3594165-pdvclient-encrypt-vault into 1.x

Adds an optional per-connection encryption Key; HandleStore AEAD-encrypts handles at rest (libsodium XChaCha20-Poly1305, HKDF-derived per-connection key, AAD bound to connection+uid). Opt-in, fail-closed on write, graceful re-consent on read failure. No dependency on the main pdv module. See https://www.drupal.org/project/pdv/issues/3594165 . Verified: phpcs + phpstan (level 1) clean, pdv_client kernel suite 46 tests green incl. a new HandleStoreEncryptionTest (round-trip, tamper, AAD binding, fail-closed).

Merge request reports