Add support for Secure Boot / Flash Encryption when flashing nodes

**Describe the problem you have/What new integration you would like**

Add the ability to sign and encrypt binaries before uploading firmware to node. Enabling this would help secure any wifi passwords / sensitive keys that exist in the plaintext firmware. This could be implemented through additional optional flags in the esphome cli. Alternatively, adding the ability to run a preprocessing script / hook before upload might also fulfill this need.

**Please describe your use case for this integration and alternatives you've tried:**

I have an ESP32 device that has secure boot and flash encryption keys already burned that I would like to convert to an ESPHome node. I would like to have a way to point the esphome cli to the secure boot and flash encryption keys to use while uploading new firmware to the device. Being able to do this OTA would probably add a bit of complexity with managing keys for every node, but as a first pass - being able to provision a secure node manually would be very useful.

**Additional context**

The payload names no files or tests; begin by tracing the ESPHome CLI upload flow and the ESP32 secure-boot and flash-encryption requirements. Define the supported key inputs and manual provisioning path first; done means a node can be flashed with firmware signed and encrypted using the supplied keys.

Written by the indexing model from the issue text.