feat: encrypt gitsshkeys.private_key at rest via dbcrypt (#25872)

Adds an optional dbcrypt wrapper around gitsshkeys.private_key. The
column is encrypted on insert and update through enterprise/dbcrypt when
external token encryption is configured, and decrypted on read.

A new private_key_key_id column references
dbcrypt_keys(active_key_digest) so revocation safety is enforced by the
existing foreign key. Rows with a NULL key_id stay plaintext and remain
readable. Existing plaintext rows can be backfilled by running `coder
server dbcrypt rotate`.

Generated with assistance from Coder Agents.

coderd/database/queries/gitsshkeys.sql

@@ -5,10 +5,11 @@ INSERT INTO
 		created_at,
 		updated_at,
 		private_key,
+		private_key_key_id,
 		public_key
 	)
 VALUES
-	($1, $2, $3, $4, $5) RETURNING *;
+	($1, $2, $3, $4, $5, $6) RETURNING *;
 
 -- name: GetGitSSHKey :one
 SELECT
@@ -24,9 +25,9 @@ UPDATE
 SET
 	updated_at = $2,
 	private_key = $3,
-	public_key = $4
+	private_key_key_id = $4,
+	public_key = $5
 WHERE
 	user_id = $1
 RETURNING
 	*;
-