AES key rollover

[Cantor, Scott]

There's some limited support now in the DataSealer class for handling key
rollver of the symmetric encryption key used for stateless clustering
features, but I need to operationalize it.

What I don't want is to have to change the actual sealer configuration
every time you roll the key over to accomodate different key aliases
because that implies restarting the IdP. What I think would be better is
to have explicit key versioning embedded in the alias names used, so that
the DataSealer class can look up the current key version to use and notice
when it's been changed on the fly either by adding a small I/O per
operation or maybe with a background thread to monitor the version.

I changed the property name to reflect that purpose better. Instead of
looking for idpSecretKey, it would look for idpSecretKey<version> where
version is an increasing counter.

What I was hoping was to be able to do this within the keystore itself
using some kind of metadata, but it looks like extensible entry attributes
are a new feature with Java 8. So for now, I think having a separate
parallel file to track the key version is probably the best option, and I
can write a simple tool class to maintain the keystore and key version
file as a unit. We can migrate off of that once Java 8 is a required
minimum version.

-- Scott