Support validated/authenticated payloads

Describe the solution you'd like

Users send encrypted payloads, but server accepts all forms of payloads. Many users want to restrict payloads to only ones they create.

This can be done a few ways. To me the most obvious/simplest approach is that we have server/namespace-level public keys from a user (w/ full CRUD API, RSA or ECDSA only at first probably) with an identifier for each key and if any have been configured, use https://pkg.go.dev/go.temporal.io/api/proxy#VisitPayloads via interceptor to ensure that every non-search-attribute payload has a keyId payload metadata entry for a known key, and a signature payload metadata entry that uses that public key to validate that signature against the data contents. Cloud can have its own way to configure server/namespace-level keys.

Start by reviewing the proposed use of go.temporal.io/api/proxy.VisitPayloads and determine how server- or namespace-level key configuration and CRUD would fit. Define the supported key types, metadata and signature validation behavior, including the Cloud configuration boundary. Done requires an agreed design and implementation scope; the issue names no files or tests.