Encrypted roots

This is continuation of #252

It would be nice to have a preference to make certain roots fully ecnrypted, meaning that any new resource appeared in its folder would automatically encrypt. See https://github.com/cryfs/cryfs for inspiration.

Start by reading issue #252 and the CryFS project linked in the description to understand the existing root model and encryption approach. Define how a preference marks roots for full encryption and how newly appearing resources in those folders should be handled; the issue provides no files or tests to run, so the relevant entry points must first be located.

Written by the indexing model from the issue text.