Implement AWS KMS secret encryption backend

Created by: eseliger

I've followed the guide here for implementing a new encryption backend and AWS doesn't seem to have a CRC32 checksum to test against, and there are no real "versions" of encryption keys(they can rotate in the background but as far as I understood it that's opaque to the API consumer), so I think the version function is not super useful here, but that's how far I got and understood the code. Can someone please check if this makes sense and tell me if something is missing here?

Closes https://github.com/sourcegraph/sourcegraph/issues/19983