KEK response handling

From the perspective of pilot, it will **always** ask copilot for a key, as it's intended to be a "dumb" keyprovider. We need to integrate response handling for the following conditions:

- [x] KEK authorized (implies KEK is returned in response) (200)
- [ ] KEK unauthorized (unauthenticated) (401)
- [ ] KEK forbidden (403)
- [ ] KEK not found (404)
- [ ] null response (e.g. timeout)

Because ocicrypt doesn't seem to have robust stderr logging for this operation, we'll need to raise verbose logging exceptions for unauthorized responses. Because we will later implement platform attestation integration, I don't think we'll want to have detailed unauthorized justifications logged locally, considering the reason might be that a given cluster/environment has been compromised.

EDIT: Added 401 for scenarios where pilot has yet to be authorized. Generic response in all cases until copilot has a record of the pilot agent and it is authorized.