AES-256-GCM encryption for job args at rest.

When encryption is configured, job arguments are encrypted before insertion and decrypted after claiming. This is transparent to workers.

Single key

{shigoto, [{encryption_key, <<"32-byte-secret-key-here..........">>}]}

Key rotation

Use encryption_keys (list, newest first). New jobs are encrypted with the first key. Decryption tries each key until one succeeds.

{shigoto, [{encryption_keys, [
    <<"new-32-byte-key..................">>,
    <<"old-32-byte-key..................">>
]}]}

Old jobs are re-encrypted with the current key when claimed and re-inserted (e.g. via retry). The old key can be removed once all jobs encrypted with it have been processed.