Feature request - support for column encryption with `pgcrypto` module

We are using target-postgres with Postgres 13 on AWS RDS Aurora.

A lot of the data that we are moving from upstream sources into Postgres has been encrypted in the source system, and can't be decrypted within Postgres after it is loaded.

I have written a custom mapper/transform plugin using the SDK that can decrypt all of these records during meltano run, but I don't want to write them to the database as plain text - there is sensitive data in there (PII) and I would like to keep this data encrypted at rest.

What I'm hoping to achieve is something like this: for a given target-postgres plugin instance, configure it with a column name and an encryption key, and have the tap use the pgp_sym_encrypt function of the pgcrypto module.

I'm happy to try to contribute this feature myself but I wanted to open an issue first and see if there is a best way to make this change.

Start by reviewing the target-postgres plugin's configuration and record-writing entry points, then read PostgreSQL's pgcrypto documentation for pgp_sym_encrypt. Define how a plugin instance selects encrypted columns and supplies keys, and verify that decrypted values are never written as plaintext while normal columns continue to load.