Support decrypting credentials using an external certificate (aka "make secrets portable")

As a user I want to share a single configuration file between multiple Jenkins instance, including credential definitions. Currently JCasC support plugin supports defining encrypted secrets on the configuration YAML. Configuration example:

```yaml
credentials:
system:
domainCredentials:
- credentials:
- usernamePassword:
id: "exampleuser-creds-id"
username: "exampleuser"
password: "{AQAAABAAAAAQ1/JHKggxIlBcuVqegoa2AdyVaNvjWIFk430/vI4jEBM=}"
scope: GLOBAL
```

Encryption is done using the Jenkins-internal secret key which is unique for every Jenkins instance. It means that the credentials are not portable between instances. It also creates obstacles for immutable images which start with a fresh Jenkins instance and initially do not have an initialized secret key for encryption. Although there are workarounds, I suggest adding support of external certificates.

Proposal:

* Users can refer external credentials using a custom string, e.g. `{ENC, PKCS7,AQAAABAAAAAQ1/JHKggxIlBcuVqegoa2AdyVaNvjWIFk430/vI4jEBM=}` (encryptted text)
* Encryption keys can be passed through a file. Path to it can be defined via environment variable or the JCasC context configuration section
* Nice2Have: Arbitrary encryption engines are supported, maybe using an extension point

Implementation notes:

* The logic can be implemented using a new `SecretSource` class which includes underlying extensions for encryption methods