Adds Vault KV v2 support

[Raven-182]

Adds support for Vault KV v2 while keeping KV v1 as the default for existing deployments.

Changes

Vault KV support

Add an optional kv_version setting to vaultlocker.conf.

This is needed because the HVAC APIs and response formats are different for KV v1 and KV v2.

When the setting is omitted, vaultlocker continues to use KV v1, so existing deployments do not need to update their configuration.

Only KV versions 1 and 2 are accepted.

Secret storage

Add separate KVStoreV1 and KVStoreV2 implementations for the HVAC KV APIs.

This:

• Uses the configured KV mount and version.
• Handles the different KV v1 and KV v2 read response formats.
• Provides the same read, write, and delete interface to vaultlocker.
• Permanently removes the secret and its metadata when deleting a KV v2 secret.

Update the encrypt and decrypt flows to use the new storage interface.

Compatibility

KV v1 remains the default, so existing deployments continue to read and write keys from the same paths.

Operators who want to move an existing mount to KV v2 can use
Vault's in-place KV upgrade
and then set:

kv_version = 2

Vaultlocker does not need a separate migration command because this is handled by vault.

Tests

• Add unit tests for KV v1 and KV v2 reads, writes, and deletes.
• Test the default and configured kv_version values.
• Update the encrypt and decrypt tests to use the new storage interface.

Manual testing

Manually verified the vaultlocker encrypt and decrypt flows using Vault KV v1 and KV v2.

Assisted By: GPT-5.6 Sol

Related-bug: #2158148
Jira: OPEN-4605