Accept expected encryption context as input to Decrypt

In the ESDK the `Decrypt` operation does not offer a way to validate the encryption context in any way. It does return access to the validated encryption context. We tell people that they MUST verify the encryption context, but do not provide good guidance on what exactly this means. This leaves the work to the customer and abdicates our responsibility. Mechanisms trump good intentions, and the current API is a triumph of good intentions.

Our examples always demonstrate this verification, but since they often demonstrate the encryption and decryption process within the same code context, it doesn't help illustrate whether the decryptor needs to provide all or just a subset of the encryption context.

We should at a minimum accept the expected encryption context as input to `Decrypt` and verify that it matches the encryption context provided to `Encrypt`.

(credit to @seebees for some of these words)