Encrypt cache used by ske kubeconfig login

[MichaelEischer]

Description

ske kubeconfig login stores retrieved credentials on-disk in a cache. Those files should be handled like secrets but are too large to be stored in the keyring. Thus, just encrypt them with AES-GCM using a secret key that is stored in the keyring. The extra security provided by this is somewhat limited as someone who's able to read the cache entry is likely also able to call the stackit cli to retrieve the decrypted value. However, this encryption ensures consistent secret handling by being consistent with the normal access token that is also stored in the keyring.

There is no need for a migration of existing cache entries as the tokens there are short-lived and will be automatically refreshed if they cannot be read from the cache.

The go docs for cipher.NewGCMWithRandomNonce state that a key should only be used at most 2^32 times. This limit is unlikely to be ever reached, so I've opted for the simplest option and just refresh the key every 90 days, which is already more than enough. This also provides a good opportunity to clean up stale files in the cache.

Relates to STACKITSKE-4927

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Examples were added / adjusted (see e.g. here) not relevant
• Docs are up-to-date: make generate-docs (will be checked by CI)
• Unit tests got implemented or updated
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)