Current implementation can allow tampering and the CTR->GCM exchange can
help to avoid it.
This commits also alters a behaviour where we moved ahead after failing
to decrypt a recovery document. IMHO we can't move ahead as this is a
fatal error.

Signed-off-by: Victor Shyba <victor1984@riseup.net>

Integrated the secrets's JSON key that specifies ciphers into _crypto
and added optional GCM. Also added a test to check if both cipher types
can be imported.

Resolves: #8680
Signed-off-by: Victor Shyba <victor1984@riseup.net>

Resolves: #8668 - client: substitute usage of CTR mode + HMAC by GCM
cipher mode

Signed-off-by: Victor Shyba <victor1984@riseup.net>

Our magic value wasn't being used and were represented as a string.
Refactored it to a constant, increased it's size to 2 bytes and optimzed
is_symmetrically_encrypted to look for the magic and symmetrically
encrypted flag under base64 encoding. Most file types will use this
feature to help identifying themselves, so it got refactored to serve
the purpose it was created.

Naming, interfaces and other details.

AESWriter and HMACWriter are just applying hmac or aes into a flow of
data. Abstracted the application of those operations into a super class
and highlighted just the difference on each implementation.

VerifiedEncryptor and VerifiedDecryptor are just a pipe and a fan-out.
This class provides both behaviors to two distinct writeable things.

After adding the streaming decrypt, some classes were doing almost the
same thing. Unified them.
Also fixed some module level variables to upper case and some class name
to camel case.

Some exceptions were missing a proper description and client_side_db.py
script wasn't capturing logs from Twisted.

Unfortunately, if a doc finishes decryption before the previous one we
will still have an issue while inserting. This commits solves it by
adding the parse and decrypt inside of the semaphore.