Improve decryption lookup performance

The KMS lookup is really handy for field level encryption, but it's also really slow if you use it a lot. This is because:

1. Each `${kms}` lookup is a separate network call to `kms:Decrypt`
2. `kms:Decrypt` calls happen sequentially, instead of in parallel.

It may be nice to support a new `${decrypt}` lookup, using something like [NaCl secretbox](https://pynacl.readthedocs.io/en/stable/secret/#example), backed by a data encryption key from kms. This would allow you to keep a top level data encryption key (e.g. returned from `kms:GenerateDataKey`) and use it to perform fast decryption of field level values within variables.

An example stacker config might look like:

```yaml
encryption:
key_a: ${kms us-east-1@}

stacks:
- name: app
variables:
SuperSecretThing: ${decrypt key_a@}
```