tests: add ducktape tests for broker-side field-level encryption

Three tests:
- test_encrypted_produce_consume: verify fields encrypted with mock KMS
- test_no_encryption_passthrough: verify no-op without encryption config
- test_json_encrypt_decrypt_random_access: produce 200 JSON records,
  consume in random order, unwrap DEK with mock KMS key, decrypt each
  field with AES-256-GCM, verify plaintext matches expected value
test_dek_rotation remains @ignore pending timing support.

Signed-off-by: Evgeny Lazin <4lazin@gmail.com>

Author: Lazin