Provide better error message for incorrect password

Currently the error for generating a new device with an incorrect password is `IronOxideErr::AesError(Unspecified)`. This comes from `ring::aead::OpeningKey.open_in_place()` for the decrypt case, but it comes from other places as well (like `encrypt_user_master_key()`).

We should make a better error message for these failure cases.

Start by tracing the incorrect-password path through ring::aead::OpeningKey.open_in_place() and the other failure paths mentioned, including encrypt_user_master_key(). Identify how IronOxideErr::AesError(Unspecified) is produced, then add a more useful error message for these cases and verify the affected error behavior.

Written by the indexing model from the issue text.