Support encrypting an entire file.

This should follow the algorithm here https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html, but with some confcrypt conventions. The gist of it is:

1. Introduce a new command group `large` that supports `read` and `encrypt`
2. `read` should create an unencrypted file with the final `.econf` extension stripped
3. `encrypt` generates a new confcrypt file with an extra `.econf` extension added on
4. In an encrypted file, the encrypted key is stored in the `KEY` parameter, while the data is stored in `FILE`. This is a convention expected and enforced by `confcrypt`.

And there we go, that should provide whole-file encryption.