Per item key fingerprints for efficient key retrieval

Currently the controller tries to unseal each item of a secret with all the active private keys.
This becomes inefficient if the key rotation is aggressive enough and/or when enough time passes to accumulate enough active keys without obsoleting old keys.

We need a better way. I propose to prepend a key identifier of the key used to encrypt an item to the encrypted data item itself. The controller would then locate the right private key.

Implementation notes:

I suggest using the hash of the public key rather than a stateful ID such as the key pair secret name.
We already internally keep an in-memory fingerprint->key map; we could also actively fill this cache by including the hash in a label of the secret objects that store the controller key pairs.

Start by tracing the controller's current per-item unsealing path and the in-memory fingerprint-to-key map. Then inspect the secret objects that store controller key pairs and determine how their labels can support cache population. Done means encrypted items identify the matching private key without trying every active key, with behavior verified by relevant tests.

Written by the indexing model from the issue text.