add support or verify support of OCI crypt

It'd be great to be sure we support [OCI crypt](https://github.com/containers/ocicrypt); it'd greatly help use cases of embedding secret data inside a bootable container image. I need to dig into the flow for this.

Clearly for a `bootc install` style flow we'd need to have the provisioning system (e.g. cloud-init -> AMI or Anaconda) *also* be configured with decryption keys.

We should definitely still support secrets other ways too; I think support oci-crypt would be also be natural when we extend support for configmaps and particularly secrets.