key-wrap/src

@oktoid/key-wrap: protecting a data key at rest under a key encryption key.

The port (KeyWrap), its software adapter (createSoftKeyWrap), which holds the key encryption key in this process and refuses to start under production, and its hardware adapter (createHsmKeyWrap), which leaves the key on a token behind KeyCustodian. The package has no native dependency, on purpose: everything that stores personal data imports the port's type.