backup: unify online restore's encryption scheme with pebble's EAR

Currently, `BACKUP`/`RESTORE` uses a bespoke AES-GCM chunked encryption scheme for encrypted backups. Given that online restore pushes decryption work into pebble at download time, there is an opportunity to unify our scheme with pebble's native encryption-at-rest functionality.

Some differences between the schemes that will impact considerations here:
- pebble's EAR uses AES-CTR, depending on the compatibility story we want to support, we will either need to teach pebble how to decrypt AES-GCM schemes, or adjust our backup scheme to use the CTR variant
- backup/restore encryption uses 64kb chunks, we should potentially make our chunk size smaller (closer to 4 or 8 kb) for optimal usage by pebble. This has the added benefit of making small point reads during the download phase more performant.

Additionally, the work done in https://github.com/cockroachdb/cockroach/issues/161169 will likely impact the decisions we make here.

Jira issue: CRDB-64067