feat: encrypt gitsshkeys.private_key at rest via dbcrypt (#25872)

Adds an optional dbcrypt wrapper around gitsshkeys.private_key. The
column is encrypted on insert and update through enterprise/dbcrypt when
external token encryption is configured, and decrypted on read.

A new private_key_key_id column references
dbcrypt_keys(active_key_digest) so revocation safety is enforced by the
existing foreign key. Rows with a NULL key_id stay plaintext and remain
readable. Existing plaintext rows can be backfilled by running `coder
server dbcrypt rotate`.

Generated with assistance from Coder Agents.

docs/admin/security/database-encryption.md

@@ -24,6 +24,7 @@ The following database fields are currently encrypted:
 - `external_auth_links.oauth_refresh_token`
 - `crypto_keys.secret`
 - `user_secrets.value`
+- `gitsshkeys.private_key`
 
 Additional database fields may be encrypted in the future.