feat!: read a value or a secret at the keyboard, and open an encrypted key with one

[lomigmegard]

Closes #203.

Two actions read a value at the keyboard. enter_value makes an artifact the transcript carries, such as a serial number read off a device. enter_secret makes a secret artifact it never carries: echo is off, the artifact is wiped from memory when the run ends, and the transcript records that a secret was entered at the step and nothing derived from it. The action name is what decides, so a passphrase step reads as one in the YAML and in the printed script.

unlock_the_escrow_key:
  action: enter_secret
  with:
    message: "Passphrase for the escrow key"
  creates: escrow_passphrase

install_the_escrow_key:
  action: import_key
  backend: openssl
  reads:
    key_material: ${artifact.escrow_key}
    passphrase: ${artifact.escrow_passphrase}
  with:
    algorithm: RSA-4096
  creates: escrow_keypair

Both actions take format: (text, digits, alphanumeric, hex, base64, or { pattern: "..." }) and a length. The rule is stated in the prompt before typing, and a refusal names the rule, never the value. For an encoding the artifact is the decoded bytes, so DE AD BE EF and deadbeef give the same artifact. The PIV PIN prompt uses the same check.

import_key reads an optional passphrase through reads: and opens an encrypted PEM (PKCS#8 or traditional) or an encrypted PKCS#8 DER. Only a secret artifact is accepted as the passphrase. A passphrase given for material that is not encrypted is refused.

Breaking changes:

• KeyStoreBackend::import_key takes a passphrase: Option<&[u8]>.
• rite check refuses a reads: key that the action does not read, as it already did for with:.
• oral_readback no longer accepts sensitive, which had no effect.

The headless driver answers a formatted prompt with a value that fits the format, so a dry run goes through PIN and passphrase steps. The import_key showcase gains a section that installs an escrow key from an encrypted PEM. User documentation is in docs/typed-entry.md.