Encrypt backups written into file

Backups are currently unencrypted. Secure way to transfer backups is over the network using the backup transfer function ("Add second device" in the UIs). When it does not work, users export the backups which stores to Downloads folder on Android, see [forum topic](https://support.delta.chat/t/multi-device-ux-is-absolutely-horrible/4612). See also https://support.delta.chat/t/researching-a-zero-trust-storage-layer-for-deltachat-core-rust-thoughts/4554/7

[rPGP](https://crates.io/crates/pgp) crate that we use supports streaming encryption and decryption with AEAD modes of [the latest standard of OpenPGP](https://www.rfc-editor.org/rfc/rfc9580). Mandatory to implement AEAD mode is OCB, so encrypted backup format should likely be an OpenPGP binary message with an SKESK packet (with [Argon2](https://www.rfc-editor.org/rfc/rfc9580#section-3.7.1.4) which is also supported) followed by SEIPD v2 in OCB mode. We already have a function to export backups into streams, this is used both when exporting into files and when exporting over the network when "Add second device" procedure is used:
https://github.com/chatmail/core/blob/82a0d6b0abee73432d30b33ebcc2358afd0904eb/src/imex.rs#L452

We definitely don't want users to provide their own passwords in the UIs, and don't want each UIs to have its own code to generate passwords. Passwords should be generated by the application as a string of digits separated by `-`, similar to Autocrypt Setup Message or Signal passwords for backups.

I have not figured out API details, but one way is to have a separate API to generate the password and then UI can pass it back to backup API after displaying the password to the user.