RANGER-5773: Harden encryption of stored service configuration secrets

[vyommani]

What changes were proposed in this pull request?

Strengthens how Ranger Admin protects certain encrypted configuration values (e.g. service
connection passwords) at rest, and migrates existing data to the improved approach. New writes
get the improved protection immediately; a one-time patch upgrades data written before this
change.

How was this patch tested?

Ran end-to-end against a real running instance (dev-support/ranger-docker), not just unit
tests, using genuine legacy-format data:

• Migration: all genuinely-legacy rows converted; each row's stored value differs from its
  pre-migration value (confirms a real decrypt/re-encrypt, not a relabel); zero failures.
• HA mismatch: pointed one node at a different key than the one data was migrated under —
  fails closed with an actionable error instead of a silent bad-password auth failure; reverting
  the key restores correct decryption.
• Idempotency: re-running the migration patch against already-migrated data is a no-op, no
  failures.
• Full mvn test / project build verification is still pending — this pass was done in an
  environment without Maven Central access, so verification so far is against the modified
  classes compiled and run directly, not through the project's own build.

Open questions for reviewers (flagged in-code, not silently decided)

1. Migration patch runs single-pass/single-transaction (matches existing precedent in this
   codebase) — acceptable at very large scale, or should it batch?
2. The new consistency checker WARNs and lets startup continue on a key mismatch rather than
   failing it outright, to avoid turning a legitimate transient state (e.g. an in-progress key
   rotation) into an outage. Right trade-off, or should a hard mismatch block startup?
3. The new read-path branch relies on the new decrypt call throwing reliably on a wrong key,
   rather than repeating the existing byte-exact re-encrypt-and-compare self-check the legacy
   branches use. Is that reliance justified as-is?