Adiantum encrypting VFS improvements.

[ncruces]

Goals:

1. find a way to encrypt sub-journals (and other temporaries) or scream that we can't.
2. figure out a better API to set keys, that works with the above.

(1) Is important because most temporary files can hold database data, not just temporary tables, but transient views, sorter data, etc. I'd rather fail loudly than persist that data. We can also hold it in Go, rather than guest, memory.

(2) Would be nice because URI parameters are easily available to other parts of the application. A solution that works with ATTACH is elusive, though.

[ncruces]

ISTM that the best way to handle temporaries is to use a random key for every file that has empty path and OPEN_DELETEONCLOSE and see if that covers everything. For these files we can even keep a length, avoiding the only issue Adiantum can't transparently handle (partial blocks at the end).

Users that don't want the overhead can still use PRAGMA temp_store.

[ncruces]

Any solution to (2) needs to be in addition to URI parameters, I guess. It's not just ATTACH … KEY (that we can't do without patching SQLite). A PRAGMA would probably solve that.

It's our backup API that assumes URIs. Forcing users to set keys through a _pragma=textkey(pass) URI parameter, because URI parameters are bad, is a roundabout way to do it.

With URI parameters keys will be in guest memory for the duration of the connection. But we currently don't expose any API to retrieve them. So maybe that's OK?