Support encrypt to public keys

The current `DocumentOps::document_encrypt` allows the caller to specify user/groups by ID. The service then looks up the public keys for the users/groups for encryption.

It would be nice if we provided an interface that also allowed encryption directly to public keys (if the caller already has them). This will save 2 calls to the service.

An internal API already exists with (almost) this functionality. See `internal::document_api::recrypt_document`

Start with the public DocumentOps::document_encrypt interface and compare it with internal::document_api::recrypt_document, which is identified as having almost the needed functionality. Trace how user and group IDs are resolved to public keys, then define the direct-public-key interface and verify that it avoids those service lookups while preserving encryption behavior.

Written by the indexing model from the issue text.