Add a wrapping key to encrypt/ decrypt operations

Right now, secrets are passed from clients to the Barbican server encrypted only be SSL. In Common Criteria environments, this is insufficient. Secrets need to be additonally encrypted at the point of origin, and ideally only decrypted where the secret will be stored. In a case where a hardware token is used, this would be on the token, so that even if an attacker gains access to the Barbican server and introspects the process memory, no secrets can be deciphered. This blueprint discusses the changes needed on the server side to implement this feature.