AES-256-GCM encrypt/decrypt implementation with key rotation metadata.
Payload format:
<<version::8, key_id::32, iv::binary-16, tag::binary-16, ciphertext::binary>>
@spec decrypt(binary()) :: {:ok, binary()} | {:error, term()}
@spec encrypt(binary()) :: {:ok, binary()} | {:error, term()}