refactor(secret): use aws-lc-rs to replace aes-gcm crate

[yuhao-su]

I hereby agree to the terms of the RisingWave Labs, Inc. Contributor License Agreement.

What's changed and what's your intention?

aws-lc-rs has completed FIPS validation. We will add an option to enable FIPS compliance in a separate PR.

The aws-lc-rs version is set to 1.6 to align with our rustls version 0.23.5. Also only aws-lc-rs<1.12.0 has passed the FIPS validation.

I locally tested that encryption/decryption results from both aws-lc-rs and aes-gcm are identical.

Checklist

• I have written necessary rustdoc comments.
• I have added necessary unit tests and integration tests.
• I have added test labels as necessary.
• I have added fuzzing tests or opened an issue to track them.
• My PR contains breaking changes.
• My PR changes performance-critical code, so I will run (micro) benchmarks and present the results.
• My PR contains critical fixes that are necessary to be merged into the latest release.

Documentation

• My PR needs documentation updates.

Release note

[zwang28]

FYI I've CryptoProvider::install_default globally.

• fix(runtime): set default crypto provider #19136
• fix: use ring as default provider #19874

[yuhao-su]

FYI I've CryptoProvider::install_default globally.

• fix(runtime): set default crypto provider #19136
• fix: use ring as default provider #19874

Got it. This PR only uses aws-lc-rs in non fips mode. Not sure if can cause the same problem as the rustls

[tabVersion]

The impl LGTM

This PR only uses aws-lc-rs in non fips mode.

Where do we control the FIPS mode?

Also only aws-lc-rs<1.12.0 has passed the FIPS validation.

Can you also share some docs about the FIPS validated versions?