Allow NanoTDFs to be created in 'offline' mode, by passing in fore-knowledge of KAS public (EC) key information

[dmihalcik-virtru]

Currently, we support creating ZTDFs in 'offline' mode with the WithKasInformation (which allows setting a single public key), and via the Cached field in the key access registry, which allows loading KAS public key information from a third party. We should make this work explicit by allowing several options for configuring the KAS public keys.

func (s *SDK) StoreKASKeys(url string, keySet ...*policy.KasPublicKeySet) error: Load the given keys

Follow up work:

• Prefer looking up KAS key from KAS registry (Go SDK: Prefer looking up KAS keys from registry over directly querying the KAS #1555)

---

Original Proposal:

1. func WithKASKeys(cached_keys ...*policy.KasPublicKeySet) Option: Configure the SDK's keyCache with the given pre-loaded items.
2. func WithKASLookup(f ...KASKeyLookup) Option: Replace the KAS key lookup with a function; can be called multiple times.
   a. type KASKeyLookup func{string) (*policy.KasPublicKeySet, err): type used for KAS public key lookup
   b. func KASKeyDirectLookup(url string)(*policy.KasPublicKeySet, err): current behavior (default)
   c. func KASRegistryKeyLookup(url string)(*policy.KasPublicKeySet, err): check a registry for the key in its cache

Optional:

• Add equivalent options for encrypt (createX) and any tamper check functions, if those exist, to allow finer-grained control over the public key lookup
• Separate out allowlist behavior explicitly? Or at least describe how to implement it with middleware.
• deprecate existing methods that don't provide sufficient functionality (nano one just doesn't work; ztdf one doesn't allow multiple keys, and therefore doesn't support algorithm choice)