Consider replacing Fernet for new raft encryption records

• relates to https://github.com/moby/swarmkit/pull/2535

Fernet support was added to SwarmKit to provide a FIPS-compatible alternative to NaCl secretbox. Since then, Go has gained native FIPS 140 support for standard-library cryptographic primitives, making alternatives such as AES-GCM practical without relying on Fernet.

The fernet-go module also appears lightly maintained and has no tagged releases, leaving consumers pinned to pseudo-versions.

We should investigate:

• using a stdlib AEAD, likely AES-GCM, for newly written encrypted raft records;
• whether the existing FIPS/non-FIPS write-format split can be removed;
• retaining Fernet decryption, and probably the fernet-go dependency initially, for existing raft state, backups, and migration compatibility.

This would not initially remove Fernet support entirely; it would only stop creating new Fernet-encrypted records once compatibility and mixed-version upgrade behavior have been addressed.

Start with the related PR #2535 and trace the current Fernet encryption and decryption paths for raft records, including FIPS and non-FIPS write formats. Investigate a standard-library AEAD for new records while preserving Fernet reads, then verify compatibility with existing state, backups, and mixed-version upgrades.